ITSM ticketing systems [/ˈitsm ˈtɪkətɪŋ ˈsɪstəmz/] n - If monitoring is how the operations center senses, the ITSM ticketing system is how it remembers and acts. Tools like ServiceNow and Jira are where an alert becomes a tracked piece of work, where priorities are fixed, and where the auditable history of what we did abides. A great part of my IOC operations role is keeping that system tuned, so that it serves the work rather than becoming the work.

What Falls to Me to Tune

• Intake and routing. [/ˈɪntækɛ ˈænd ˈræʊtɪng/] n Alerts from Tuning alert thresholds should open tickets and land in the right queue of themselves, enriched with rack, row, customer, and severity. Manual transcription is both slow and a wellspring of bad data.
• Priority and SLA timers. [/ˈprɪɒrɪti ˈænd ˈslæ ˈtɪmɛrs/] n Priority must map to real impact, and the ticket’s response/resolve clocks must reflect the customer’s contractual commitments, so that breaches show themselves before they cost a credit, not after.
• Workflows and states. [/ˈwɒrkflɒws ˈænd ˈstætɛs/] n A clear, enforced lifecycle (new, triage, in progress, resolved, with an On Running the Root-Cause Inquiry sub-task spawned for severe incidents) keeps tickets from languishing in limbo.
• Forms and fields. [/ˈfɒrms ˈænd ˈfɪɛlds/] n I hold required fields minimal but meaningful. Every field I add is one a human must fill, so it has to earn its place by feeding a report or a search in some later season.

Of ServiceNow and Jira

In the shops I have worked, ServiceNow is apt to be the system of record for incident, change, and problem management: a strong workflow engine, good for audit and for the formal ITIL processes leadership cares about. Jira is apt to bear the engineering follow-through: the corrective-action backlog from RCAs, tool improvements, and the On Finding the Gaps in One’s Tools work. A clean link between the two, incident in ServiceNow and fix in Jira, is what stops “we’ll fix it” from quietly evaporating.

Why This Diligence Matters

A ticketing system is the raw stuff of nearly everything downstream: metrics are only as good as the data in the tickets, On Running the Root-Cause Inquiry depend upon an accurate timeline, and retention and audit depend upon the record being complete. Stale workflows, junk priorities, and free-text where a field belongs all surface later as a report you cannot trust. To tune the system is, in truth, to ward the data it yields; the access controls that decide who may alter those workflows are treated in Access and role-based controls.