Using AIM Incident Manager
The Incident Manager provides a view of all incidents received by Advanced Insight Manager. Incidents are displayed alphabetically by organization name and device group.
Figure ___ shows the data flow through which AIM receives incident JMBs and manages them through successful case resolution.
Juniper Networks devices, configured with specialized AI-Scripts, periodically send incident and intelligence Juniper Message Bundles (JMBs) to a configured archive location. AIM connects to the archive location and periodically receives the incident and intelligence JMBs. Incident Manager displays all of the incident JMBs received. The incident owner sends an incident case ID request to JSS. JSS sends a case ID and opens a case for Juniper engineers to work on a resolution and to send case status back to Intelligence Manager.
To use Incident Manager, you must have AIM admin and AIM ownership privileges. You must also have the AIS Base (Incident-Driven Online Service subscription.
From Incident Manager, you can:
- View an incident detail
- View incident owner
- View incident status
- View case ID
- View whether an incident has been flagged to a user. Clear Flag—Removes the flag from any of the selected Incidents.
- View whether an incident has been submitted to Juniper Support Systems (JSS) for a case to be opened to receive a case ID. Submit Case—submits the selected Incident to JSS so that a case will be created. Submitting a case is only valid if only one incident is selected and if that incident has not already been submitted to the Juniper Homebase.
- Create Policy—Initiates creation of a Reaction Policy. If any Incidents are selected, the policy created will be scoped to just those incidents specified. If no Incidents are selected, then the policy will be applied to all the Incidents in the system.
- Delete any selected Incidents