Technical Support Program

Transcription

1 Technical Support Program Technical Support Program Overview of Standard Support, Premium Support and Advanced Monitoring Service March Skybox Security, Inc. All rights reserved. 0

2 Contents Introduction 1 Support Request Life Cycle 1 INFORMATION COLLECTION Account Name Module component Version Information Log File Screenshots Model Configuration Files 2 SUBMITTING A SUPPORT CASE Online Support Case Phone Support 3 TROUBLESHOOTING BY THE SUPPORT ENGINEER 3 GETTING A SOLUTION 4 CLOSING THE SUPPORT CASE 4 Case Severity Definition and Response Time 4 CASE SEVERITY DEFINITION 4 INITIAL RESPONSE TIME 6 ESCALATION PATH 6 Skybox Support Programs 7 STANDARD SUPPORT (BUSINESS HOURS) 7 PREMIUM SUPPORT (24X7) 7 ADVANCED MONITORING SERVICE 7 ADVANCED REPLACEMENT PROGRAM 9 Technical Support Policies 9 LICENSING QUESTIONS/ISSUES 9 1

3 SKYBOX PRODUCT RELEASE PLAN End of Life/Support policy 10 EXCLUSIONS 10 ENHANCEMENT AND FEATURE REQUEST PROCESS 11 CUSTOMER RESPONSIBILITIES 11 Appendix A: AMS Service Description 12 INTRODUCTION 12 SERVICE COVERAGE Service Coverage - Highlights Detailed Service Offering 13 SERVICE PREREQUISITES Platform Remote Access Connectivity Contact Point AMS Service Commencement Readiness 15 TECHNICAL OVERVIEW Highlights Details 16 2

4 Technical Support Program Introduction Skybox Security s technical support facilities are designed to assist our customers with any software and hardware issues related to the normal operation of Skybox products. Skybox s worldwide support program can provide assistance during and outside your normal business hours. In order to provide the best experience possible, our support engineers and security consultants follow strict quality management processes and procedures based on the severity level of your support issue. Support Request Life Cycle When a support case is opened with Skybox by phone or via our support portal, the request is immediately logged and assigned to the appropriate support/security engineer. Your support case will go through the following lifecycle: 1. Collecting information to help troubleshoot the issue 2. Submitting a support request 3. Troubleshooting by the support engineer 4. Finding a solution (including but not limited to workarounds, product changes and patches) 5. Closing the support request Information Collection The following section describes what types of information are needed for Skybox Security to diagnose issues quickly to resolve your support case. Please have the necessary information available prior to contacting Skybox Security Support ACCOUNT NAME Please make sure you have your account name as recorded with Skybox Security. To confirm your account name, please contact the person who manages your Skybox installation or your Skybox account manager. If in doubt, please provide the full company name (with no abbreviations). You may also obtain your account name from your Skybox license. In the Skybox console (also known as the Skybox Manager) click HelpàAboutàLicense MODULE You will need to specify which Skybox module is relevant to this support case Skybox Security, Inc. All rights reserved. 1

5 COMPONENT You will need to specify which component of the Skybox module is relevant to this support case. The list of available components is based on the module specified earlier VERSION INFORMATION You will need to specify your current Skybox product version from the HelpàAbout menu in the Skybox console LOG FILE Most issues can be quickly diagnosed by providing the log files from your Skybox product. Skybox provides an easy method of obtaining log files: Click ToolsàPacklogs in the Skybox console. Provide the necessary details to generate the logs. Please make sure the issue/incident you are reporting occurred within the timeframe specified for log generation SCREENSHOTS Screenshots will often help your support engineer to visualize of the issue you re reporting. If relevant, please take a snapshot (print screen) of the action being performed when the problem occurs MODEL Please save and provide a copy of your Skybox data model. You can save your model by going to FileàModelsàSave in the Skybox console (or as part of the packlogs as described in 2.1.5) CONFIGURATION FILES If you are reporting an issue with importing or collecting a device configuration, scan or other data source, please provide a copy of the data you were trying to import. Submitting a Support Case Customers can reach Skybox Support Center using our support phone line or our support web portal ONLINE SUPPORT CASE To file a support case online, you must have a valid Skybox customer community account. You may register for an account at It can take up to two business days for an account request to be reviewed and processed, so it is highly recommended to obtain your support portal account as soon as your account/contract is activated. 2

6 To file a new support case or check on an existing one, please sign in to your Skybox support portal account at Switch to the Cases tab. You will be able to view existing cases as well as open a new one PHONE SUPPORT You may submit a case on the Skybox support hotline 24x7. Please note that the line is monitored by operators who are trained to take messages including technical details but are not qualified to provide support or solutions. The operator will log the case, and it will then be handled according to the timetable specified in Section 4. You should also note that cases will be handled faster when submitted through the online support portal. Cases logged by phone may require additional processing time. We recommend always using the support portal to log new cases. To find support phone numbers for your region, click here. (Note: for US and Canada and Europe/international lines, select the Technical Support option.) Our operators are only able to take messages in English at this time. When filing a support case using our support hotline, please provide: Your full name Your company name Your address Phone number where you can be reached (include country code and local area code) Support request number (if the call is in regard to an existing issue) A brief description of the problem Troubleshooting by the Support Engineer A support engineer will be assigned to your case and respond within the timeframe which considers the support contract (Standard Support or Premium Support as specified in section 4) and the severity of the reported problem (as specified in section 3). The initial response may be a request by the support engineer for additional information or a notification that the investigation of your issue is now under way. In many cases, the engineer will be able to provide a workaround or an ETA for a solution. In cases where a product change is necessary to solve the issue, you will be provided with a patch once the appropriate code changes have been implemented and thoroughly tested. You may continue communicating with your support engineer through the support portal or -to-case only. You cannot provide additional information using the support hotline phone number. 3

7 Getting a Solution Your support engineer will resolve your support case by providing a workaround, instructions of how to overcome the reported issue or a patch (i.e., product update). After implementing the solution, you may confirm whether it solved your issue and close the case; you will need to communicate to your support engineer that additional information is necessary or that the proposed solution did not fully resolve your issue. The support engineer will continue working on your case until it has been resolved to your satisfaction. Closing the Support Case A support case is typically closed when you confirm that a resolution has been reached or if the Skybox support team does not hear back from you after three attempts to contact you during a seven-day period (for each attempt). Technical support cases may also be closed if they cannot be resolved, or if Skybox Security decides not to resolve certain issues, with acknowledgement and agreement from you. We may also close a case if your support contract has expired and not renewed within the allotted timeframe. Case Severity Definition and Response Time Case Severity Definition A case severity level is a measure of the relative impact of the technical issue on your systems or business. Accurately defining the issue and its severity ensures a timely and effective response by the Skybox technical support team. Skybox Support Center uphold the following case severity definitions to ensure that the appropriate resources are used to resolve all technical issues as efficiently as possible, in the right order. 4

8 SEVERITY DESCRIPTION ADDITIONAL NOTES 1 2 The Skybox production server or missioncritical business process is down and no workaround is immediately available All or a substantial portion of your missioncritical data is at a significant risk of loss or corruption You have had a substantial loss of service Your business operations have been severely disrupted Major functionality is severely impaired Operations can continue in a restricted fashion, although long-term productivity might be adversely affected A major milestone is at risk; ongoing and incremental installations are affected A temporary workaround is available Severity 1 support requires you to have dedicated resources available to work on the issue on an ongoing basis with the Skybox support engineer and be reachable during the hours defined by the support offering you purchased. 3 Partial, non-critical loss of functionality of a Skybox product Impaired operations of some components, but allows the user to continue using the products Initial installation milestones are at minimal risk 4 General usage questions, product change requests Cosmetic issues Errors in the documentation Product change requests General queries Table 1: Case severity definition 5

9 Initial Response Time Initial response time is defined as the time since the creation of the support case to when a support engineer first attempts to contact the customer for troubleshooting the reported issues or to address the support cases. Initial response time depends also on the support program that you have as specified in table 3 below. Escalation Path The Skybox support team strives to give our customers the level of support they are entitled to and assuring each support case receives the right attention until a full resolution can be achieved. If at any time we do not meet any of the commitments or if you are unhappy with the way the services are being delivered you may follow the escalation path as described below. ESCALATION LEVEL DESIGNATION/ NAME CONTACT INFO WHEN TO ESCALATE 1 Support team Press the escalation button in the support case (case is available in the customer community) Escalate Case Any concern with respect to our service performance should be raised with the support team 2 Tier 3 manager If the support team did not show any progress with the case after the customer performed level 1 of escalation 3 Technical account manager (TAM) (if TAM is assigned) If the handling of the tier 3 manager did not achieve the required progress for the case 4 Global support director If the issue is not managed in accordance with the SLA or the customer is unhappy with the way the issue is being addressed 5 VP Customer Care Moti Dror If the customer is unable to contact the support director within one working day, or if the customer is unhappy with the way the issue is being handled by the support director Table 2: Escalation path 6

10 Skybox Support Programs To support our award-winning products, we offer three global software support programs: Standard Support, Premium Support and Support with Advanced Monitoring Service, as well as an Advanced Replacement Program for customers who purchase a Skybox appliance. These choices offer the flexibility you need to select the support program that is best suited to help you maximize your investment in Skybox products. Standard Support (Business Hours) Standard Support provides access to the support knowledge base, support portal and support hotline to help troubleshoot problems and mitigate issues. During the term of your support contract, these resources enable you to submit and manage your support cases; take advantage of the latest security features; download software, upgrades, updates and patches and review Skybox Security product documentation. These services are available during local business hours, 9 a.m. to 5 p.m. Premium Support (24x7) If your business has 24-hour operations and doesn t stop for weekends or holidays, Premium Support is the right choice for you. With global coverage and highly trained technical support engineers, Premium Support has all the benefits of Standard Support available to you 24x7. In addition to around-the-clock availability, Premium Support ensures a response even outside normal business hours. If a more intensive interaction is needed with the Skybox Support Center, a Premium Support customer may request a Support Point of Contact (SPOC) from the Skybox support team for a mutually agreed upon duration. All support cases should still be submitted through the support portal, but the SPOC will monitor support cases and conduct weekly meetings to discuss status and prioritization. The SPOC will be available during your organization s local business hours. Advanced Monitoring Service Advanced Monitoring Service (AMS) is an additional service provided either with Standard or Premium Support. With the additional value of AMS, customer can focus their effort on core security activities while leaving the on-going operational and administrative work to Skybox experts. 7

11 Note: The unique benefits of support with AMS include: A dedicated Skybox AMS engineer focused on proactively optimizing and troubleshooting your Skybox deployment Proactive monitoring of model integrity and freshness to ensure solution health Hands-free administration of Skybox software and hardware configuration, software updates, backup and data collection Weekly status calls Monthly reports to review issues, activities and recommendations AMS requires a remote access connection from the Skybox Support Center to the customer s Skybox Server(s). Skybox Server(s) should be accessible via both Skybox Manager and SSH. In addition, Skybox Server should be allowed to send alerts and encrypted files on a regular basis using SMTP protocol (for more details see technical overview in Appendix A). The detailed service description of AMS can be found under Appendix A. STANDARD PREMIUM AMS SERVICE HOURS 9 a.m. 5 p.m. customer local time zone 24x7 9 a.m. 5 p.m. customer local time zone INITIAL RESPONSE Severity 1 4 business hours 2 hours Severity 2 8 business hours** 4 hours Severity 3 2 business days 1 business day According to your support program HOT FIXES & UPGRADES P P P ACCESS TO KNOWLEDGE BASE P P P SUPPORT POINT OF CONTACT P * P WEEKLY STATUS CALL P * P REMOTE SOFTWRAE UPGRADES P MONTHLY REPORT P PROACTIVE MONITORING P PERIODIC MODEL VALIDATION CHECK P 8

12 Table 3: Technical support programs comparison *Note: As described in section 4.2. **Note: Business hours are defined as 9 a.m. 5 p.m. at your locale, not including public holidays. In case the deployment is distributed among different time zones, Standard Support and AMS hours will be limited to one-time zone only, per customer s preference. Advanced Replacement Program The Advanced Replacement Program is available to customers who have purchased the Skybox Appliance and have a valid maintenance contract. This program provides a complete replacement of your appliance with a unit of the same or equivalent model or better model than was originally delivered. If Skybox Support determines the appliance needs to be replaced, a replacement unit will be shipped overnight (or by the most expedient method available) to your location if the hardware failure was identified and determined by 3pm EST. The replacement unit will come preloaded with the most current Skybox software image as well as instructions for returning the faulty unit to the manufacturer. The Advanced Replacement Program is only available for a period of three years from the original purchase of the device. Skybox may allow the customer to extend the Advance Replacement Program for a fourth year at an increased price. Technical Support Policies The following sections describe Skybox s technical support policies. Licensing Questions/Issues Please contact your Skybox account manager if you encounter licensing questions or issues. If you do not have your account manager s contact details, you may open a support case or call the support hotline. The support engineer will provide your account manager s contact details or make sure communication is established. 9

13 Skybox Product Release Plan Minor release: Skybox Security s regular product release cycle delivers a new minor release every 6-8 weeks. Minor release includes enhancements, new capabilities and bug fixes. Major release: Once a year, Skybox Security announces a major version. A major version includes the same kind of enhancements as a regular minor version. A major version typically includes upgrades to underlying technologies such as Java, database, etc. Maintenance release: Releases which includes important bug fixes, released on a weekly basis and per need END OF LIFE/SUPPORT POLICY Please refer to our End of Life Policy on our website to learn about our EOL and EOS policy. Exclusions The following cases/scenarios are excluded from the general Skybox Support Agreement: Deployment or integration work: Deployment work or assistance is not included in the support contract. In case you need any assistance in deployment or integration work, please contact your Skybox account manager or a Skybox authorized partner to discuss a possible professional services engagement. Unsupported operating systems/platforms: Skybox Security will not support products installed on uncertified or unsupported operating systems and/or platforms. Unsupported integration with third-party systems or information sources: Skybox Security will not support integration with unsupported third-party systems or information sources unless the integration work is done by a Skybox professional services engineer or certified engineer of a Skybox authorized partner. EOL products: Support for integration with end-of-life (EOL) products or versions will not be provided. Customers will be advised to upgrade before any other support steps can be performed on their cases if it is determined they are using an EOL product. Modified/custom software: Skybox will not be able to provide support for work performed by the customer or third parties, or for modifications to the Skybox database or configuration. Skybox will provide support for custom scripts created by Skybox Professional Services as part of a Skybox Professional Services engagement. 10

14 Enhancement and Feature Request Process You can log product and service enhancements or new requests through the support portal. Please select Severity 4 for feature requests. Skybox Product Management will review the request and will consider whether it is aligned with Skybox s Roadmap plan. In case Product Management accepts the request, they will determine the future release where this request will be published. Customer Responsibilities In order to be able to provide effective and timely support, our technical support team is dependent on customers response to requests for technical information and other details around the issues. Your assistance will be needed in the following areas: Gathering log files and data, as requested by the support engineer Providing a timely response to requests for technical information, such as current status of issue, recommended fixes and deployed patches Technical personnel availability for consultation, further testing and diagnosis Participating in calls and web-conference sessions, if required 11

15 Appendix A: AMS Service Description Advanced Monitoring Service Introduction Skybox Advanced Monitoring Service (AMS) enables security teams to focus on core security activities rather than on the administrative tasks associated with the deployment of a security solution. For a fixed annual fee, a Skybox engineer will remotely administer and monitor the deployed Skybox solution. An AMS agent is installed on the Skybox appliances. This agent sends statistical data to the AMS center on a daily basis to enable proactive monitoring. Service Coverage SERVICE COVERAGE - HIGHLIGHTS AMS includes: A dedicated Skybox subject matter expert focused on optimizing and troubleshooting, system configuration, software updates, backup and data collection Ensured solution health through proactive monitoring of the model validation status Monthly reports to review issues, activities and recommendations Expertise and proximity to Skybox support and product development to assess and resolve issues 12

16 DETAILED SERVICE OFFERING This section will provide a detailed overview of the AMS service offering. Data collection administration with required customer approvals o Manage changes to device connectivity and credentials o Maintain schedule for data collection within Skybox with escalation to a nominated contact if collection tasks fail for reasons outside of the control of the Skybox solution o Daily monitoring of device collection log data with escalation to a nominated contact if Skybox stops receiving log data for reasons outside of the control of the Skybox solution Model validation o Continuously monitoring the health and integrity of the model Note: Model validation monitoring will be available for customers with a Network Assurance or Vulnerability Control license only, and only in the case that model validation was part of the deployment performed by a professional services engineer. Troubleshooting of application and system issues Preventive maintenance procedures (as necessary) o Install required or desired software updates as agreed with customer. Skybox will make the customer aware when a software update is ready to be applied Customer will be responsible for managing the internal change process approvals Once the change approvals have been granted, the customer will notify Skybox who will apply the patch at a mutually agreed time o Perform backup/restore tasks o Rebuild and restore the Skybox database where required within the agreed change window o Manage authentication integration requirements Skybox intelligence feed o A check to see that the latest available Skybox content feed has been uploaded to the Skybox Server Hardware o Disk space monitoring and uptime monitoring (Skybox Server only) License consumption monitoring o License alerts provided on a monthly basis within the monthly report Managing support escalations within Skybox o All cases will be managed by an AMS engineer who will act as the customer liaison to Skybox Support and Product Development HA management o Configure HA between two Skybox Servers where required Remote assistance for rebuilding new RMA or replacement appliances once the appliances are configured with basic network settings o Restoration is done using Skybox backup and restore mechanism Weekly status call o Weekly status call with AMS engineer to review open/on-going issues 13

17 Monthly report (contains the following) o Summary of service activities Lists all issues identified in the last month, corrective actions taken, current status and next steps, if applicable o Model review General summary of the status of the Skybox deployment, including recommendations for improving the operation of the solution when applicable o o o o Support case overview Summary of all support case activity within the past month Status of all open cases, including expected remediation timelines, pending customer actions and next steps, if applicable Data freshness Summarized view of the model status, detailing devices that were not updated in the last month and any historical analysis regarding model freshness Tasks status Summary report on any failed scheduled tasks with an overview of the status of any ongoing investigations System health Disk space and general health of Skybox Servers and Collectors Service Prerequisites PLATFORM AMS s full scope is supported for Skybox appliances only (physical and virtual). When the Skybox Server is running on non-appliance machines, AMS will not cover HW and OS monitoring nor support issues related to HW or OS. Windows platform is not supported REMOTE ACCESS In order to allow proactive monitoring and effective troubleshooting, the following prerequisites must be met: Access to Skybox Manager (Skybox user interface) SSH access to all servers and collectors o The remote access technology can be defined by the customer; however, it must allow online, unattended and stable access from Skybox offices to the monitored Skybox environment Customer will allow SSH access from Skybox Servers to Collectors using keys only (without passwords) 14

18 The Skybox Server or Skybox Manager should be able to download patches from the below URLs and upload log files to Skybox operational servers: o o o o CONNECTIVITY Customer will allow Skybox Servers to send alerts and encrypted files (described below) from Skybox Servers to the Skybox AMS Center CONTACT POINT For the purposes of service efficiency and continuity, the customer will assign a single point of contact for all and telephone communications with the Skybox AMS team All communication between the customer and Skybox shall be in English language only While Skybox Support Center is open 24x7, the Skybox AMS support engineer will be available on local business hours, 9am 5pm. In case the customer s team that administrates Skybox is distributed among different time zones, customer shall select one of the regions for which AMS engineer will be available. Communication with the Skybox AMS team will use one of the following options: o Skybox customer community: o Notification to a dedicated and predefined Skybox address for AMS clients o Support hotline as described above AMS SERVICE COMMENCEMENT READINESS The AMS service is depending on validated and stable deployment. Therefore, the AMS cannot be deployed and effective prior to deployment completion. Technical Overview HIGHLIGHTS The AMS agent is a Skybox log collector agent and an client. The AMS agent collects information from the Skybox Server and sends a file containing this information to the AMS analysis center on a daily basis in an encrypted . The AMS agent package is located in the Skybox installation directory and runs as a daemon. 15

19 The AMS agent collects the following: Skybox log data Database queries System information: uptime and disk space The statistical information from the data extraction is analyzed by a proprietary analysis engine in order to identify and discover any anomalies DETAILS The AMS team will use the remote access in combination with the automatic AMS agent notifications for continuously monitoring Skybox deployment status and health. Skybox AMS platform uses an on-premises server Data Content and Security The AMS agent and analysis engine were designed to work without impacting customer security by implementing the following elements: Data content o The data collected by the AMS agent includes statistical and status information only, and does not contain any customer s sensitive data like host name/ip The content of the data sent to Skybox includes the following: Platform information o Disk space and machine uptime 16

20 Devices o Type, vendor, age, freshness and Skybox internal ID Tasks o Name, exit code, sequences, schedules and duration Data encryption AMS server AMS service can, per customer s request, support encrypted communication using TLS encryption on the SMTP server, assuming the customer s exchange server supports this capability File sent by AMS agent is encrypted using AES-256-CBC with salt Data is sent from the AMS agent running on the Skybox appliances to a secure platform using an on-premises server AMS server is hosted in an on-premises server Data is retained for three months Server is secured under Skybox security policy and has limited access to authorized support engineers AMS servers undergo periodic penetration testing and audit reviews Log Collection This section will detail the files which are sent by the AMS agent: Skybox log files o model.log Used to monitor statistical information of the number of entities in the model o tasks.log Used to monitor task exit codes, task run time, and thread consumption o error.log Used to monitor system errors o slow.log Used to identify performance degradations instances Database queries o Specific SQL queries used to monitor completeness of data feeds and to detect abnormalities in the model, like stale analysis and stale devices (device identification will be done using Skybox internal ID only) o System information Machine uptime and disk space consumption 17