IBM Support

QRadar: Support case escalations and Duty Managers

Question & Answer


Question

QRadar customers who have business-impacting software issues or Severity 1 urgent technical support cases can escalate their case. The Client Case Escalation feature offers users a streamlined process for notifying IBM that they need extra attention and connects them more quickly with resources that can assist. QRadar customers also have the ability to contact an on call Duty manager to escalate their case.

Answer

Select a tab for information about escalating your technical support case.

Support Case Escalation

Customers can now escalate their technical support case online. To escalate your case online, choose the "Escalate Case" option while viewing your open case on the support portal.

Notes:
  • Customers are not able to use the escalate case button until support has attempted first contact.
  • These escalations are short-lived to get attention to your case. Once the immediate concern of the escalation is addressed, the escalation itself is closed. Further work continues in the case, but closing the escalations allows you to reraise the escalation, should further problems arise.
  • For critical business outages where situations require immediate attention, click the Request a Duty Manager tab.
  • For more information about this feature, see How to Escalate Support Cases.


image 10962

image 10961

After completed, click submit. Your case is now escalated and a member of the technical support team is going to contact you by using your preferred method.

Request a Duty Manager

Call the IBM Support help desk and request the QRadar Duty Manager.
  • Example
    1. Call IBM Support.
    2. When the Support Representative answers, request the QRadar Duty Manager.
      For example, I need to request the QRadar Duty Manager for my case.
    3. The Support Representative transfers you to the Duty Manager phone line.
    4. The Duty Manager asks you to confirm your case number (TSxxxxxxxx).
      Note: If all Duty Managers are on calls, you might be directed to voicemail. Leave a message with your case number and contact information to receive a callback. If you cannot access or view the case number for your Severity 1 issue, the Duty Manager can attempt to look up your case information by using your company name or IBM Customer Number (ICN). 
Important: If you previously worked with a QRadar Duty Manager or Support Manager, calling a manager directly can delay your case. Duty Managers rotate weekly and assign engineers to cases for Severity 1 assistance. To ensure urgent requests are handled properly, users must contact the QRadar Duty Manager from the IBM Support phone number.
 

About Duty Managers

Duty Managers are on call QRadar Support Managers who are available 24x7 to escalate Severity 1 issues when a QRadar customer needs immediate assistance or assist with any concerns related to a case or workaround.

Common reasons to request a Duty Manager:

  1. The issue impacts your day-to-day business and requires urgent attention (escalations). 
  2. Your case is not advancing or resolved.
  3. Issues or complaints about your case or a QRadar Support Representative.

Case status is 'Awaiting your feedback'

Cases with a status of 'Awaiting your feedback' might not be able to proceed if new logs or additional information is required by IBM QRadar Support. If you are unsure how to proceed, you can update your case to request a video conference (Webex) with a support representative to collect the required data. If the status is 'Waiting on IBM' or 'IBM is Working', customers can contact the Duty Manager to get an update on your existing Severity 1 case or provide information if the issue worsens.

If your case is 'Awaiting your feedback' and you need priority assistance:

  1. Update your case severity describe any issues collecting data requested by the support representative.
  2. Call the IBM Support help desk and request the QRadar Duty Manager.


image 7843
Fig 1: A typical case cycle changes status between IBM and the user as we investigate and attempt to determine root cause.

In the example above, if IBM requests additional information the status is assigned to "Awaiting your feedback". As QRadar Support works to investigate the issue, the status can change from Waiting on IBM to Awaiting your feedback. At any time during this process, a user has the right to request extra assistance for urgent, Severity 1 issues from QRadar Support Management. We refer to this process as requesting a "Duty Manager". The QRadar Duty Manager is a 24x7 on call QRadar Support Manager who can assist with a critical problem or escalation. Duty Managers are resources intended to help resolve urgent issues and can elevate your case within the QRadar Support team or reassign workload as required within the support organization

Important: If you previously worked with a QRadar Duty Manager or Support Manager, emailing or requesting assistance via Slack can delay case response time. Duty managers rotate weekly and assign engineers to Severity 1 issues for urgent case assistance. To ensure urgent requests are handled properly, IBM employees must contact the QRadar Duty Manager from the IBM Support phone number.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Version(s)"},{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSKMKU","label":"IBM QRadar on Cloud"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSPE5X","label":"IBM Security QRadar Suite \u2013 Log Insights"},"ARM Category":[{"code":"a8m3p0000006xhlAAA","label":"Support"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
19 April 2023

UID

swg22017009

Page Feedback