AIS Workflows

There are two distinct workflows within AIS: one for incident information; the other for intelligence information. AIM periodically polls the archive location for incident and intelligence information and displays the information for a single point of management in Incident and Intelligence Manager.

Incident-Driven Analysis Workflow

The AIS incident-driven workflow occurs as follows (see Figure 5):

Figure 5: AIS Incident-Driven Workflow

1. A trigger event occurs and is detected on a device configured for and running AI-Scripts. An AI-Script is executed.
2. A tailored AI-Script builds a incident Juniper Message Bundle (JMB) with event and router data, and sends it to a designated AIM archive location.
3. AIM receives the incident JMB and displays it in Incident Manager. The incidents owned or flagged to a user appear in My AIM Home.
4. JSS creates a case. Any attachments are uploaded from AIM to JSS.
5. JSS returns a case ID to AIM.
6. JSS engineers work on the case and reports case status to AIM.

For more information about using Incident Manager, see Using AIM Incident Manager.

Intelligence-Driven Analysis Workflow

JSS receives intelligence JMBs from AIM and collects in the knowledge base. AIM periodically polls JSS for the availability of intelligence messages and created by Juniper personnel specifically for the customer. The intelligence-driven workflow occurs as follows (see Figure 6):

Figure 6: AIS Intelligence-Driven Workflow

1. An intelligence trigger event is detected on a device running AI-Scripts
2. A tailored AI-Script builds an intelligence JMB and sends it to a designated archive location.
3. AIM periodically polls the archive location and receives the intelligence JMB.
4. The customer can specify how much information is shared with JSS using AIM settings.
5. AIM displays the intelligence JMB in Intelligence Manager Information JMBs.
6. AIM periodically queries JSS for intelligence updates. Intelligence Updates consist of alerts (based on the AIM alert subscriptions) or intelligence updates created by Juniper Networks personnel specifically for the customer.
7. JSS checks to see if there are any alerts or intelligence update messages destined for the customer’s AIM.
8. JSS forwards any alerts or intelligence updates to AIM.
9. AIM receives the alerts or intelligence updates and displays them in Intelligence Manager Information Updates.

For more information about using AIM Intelligence Manager, see Advanced Insight Solutions Overview.