SmartSuite for the Systems Administrator

Monitoring event. Receives routed alerts with priority and context and records actions taken on each event.

Incident. Works escalated incidents with linked configuration items and changes.

Asset config. Updates configuration records as systems change so the CMDB stays accurate.

Security. Tracks patch and vulnerability remediation tasks by system to closure.

What does a Systems Administrator look after?

The Systems Administrator looks after the infrastructure everything else runs on: provisioning, configuring and maintaining servers, networks and platforms, applying patches and managing vulnerabilities on schedule, monitoring and responding to alerts, running backups, restores and disaster recovery tests, resolving escalated incidents and raising changes, and documenting the systems so the configuration records are current. The controls they operate, from patching to backup to logging, are the ones ISO 27001 Annex A and the CIS Benchmarks describe.

How does SmartSuite help a Systems Administrator handle alerts?

Event & Alert Management delivers routed alerts with priority and context and records the actions taken on each event, so an alert reaches the Systems Administrator with its priority set and the system it concerns identified, and what was done about it is recorded against the event. On-Call Management routes it to whoever is on call. The record of actions is what the IT Operations Director reads when asking why a recurring alert keeps recurring.

How are escalated incidents and configuration records kept in step?

IT Incident Management lets the Systems Administrator work escalated incidents with linked configuration items and changes, so an incident from the Service Desk Analyst arrives with the systems it affects and the recent changes to them, which is usually where the cause is. Configuration Management (CMDB) is updated as systems change, so the links are current and the fix the administrator makes is recorded against the configuration item. The IT Asset Manager and the IT Disaster Recovery Lead rely on that record staying accurate.

How are patching and vulnerability remediation tracked to closure?

Vulnerability Management tracks patch and vulnerability remediation tasks by system to closure, so the Security Analyst's findings become tasks against the systems the Systems Administrator owns, each with a due date, and closing the task records the patch applied. The administrator sees their remediation queue by system; the Security Analyst sees that it closed. Where deadlines are regulated, as under PCI DSS Requirement 6.3 or BOD 22-01, the task record shows the date against the clock.

How does a Systems Administrator show the IT Operations Director what was done?

Through the records the work leaves behind: actions taken on each event, incidents resolved with their configuration items, changes raised and remediation tasks closed by system. The Systems Administrator does not write a weekly summary; the IT Operations Director reads the event, incident and remediation records as they stand and sees recurring alerts, aging remediation and the systems generating most work. The same records are the evidence an auditor asks for when testing patching, logging and backup controls.

What does an infrastructure team need to begin using SmartSuite?

The system inventory with owners, the on-call rotation, the alert sources with their severity scheme and the open remediation tasks. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for an infrastructure team the first workflow is the remediation queue with on-call routing, because those are where the audit pressure and the night-time pain both sit. Monitoring tools remain the source of alerts; SmartSuite is where an alert becomes a recorded event with an action.