Environment
- Supporting Partner Opening a Case
- All Products: All Supported Versions
Objective
To provide guidance on completing the Partner Case Template.
Resolution
- Below shows the information needed to complete each question:
- Partner Internal Case Number (If Applicable): Case number from partner's own internal ticketing system
- Customer Company Name: The name of our mutual customer experiencing the issue
- Impacted Product: Name of the product at issue.
- For EDR/Hosted EDR/CB Response ONLY: (All others N/A)
- On-Prem or Cloud: Does the EDR server reside on-premise either with the partner or with the customer, or does it reside in the VMWare Carbon Black-owned cloud?
- Instance Alias: The name under which the EDR instance was registered with VMware Carbon Black.
- For CBC cases ONLY:
- Production environment: To determine the production environment, examine the URL list and find the production environment that corresponds to the URL used to log into the console.
- Org ID: Either the name of the org (usually found in the upper left-hand side of the screen at the top of the dark grey menu banner, e.g. exampleorg.com) or the Org ID number in the console.
- Sensor Name/ID: If applicable; this information is in the CBC console/UI and indicates the computer name or identifier of the sensor. This is NOT the same as the sensor version, which is usually designated #.#.#.### (eg, version 3.8.0.535).
- Server Version: Version of the EDR or App Control server. This only applies to on-prem instances, otherwise mark this N/A.
- Sensor Version: Version of the sensor installed on the endpoint that is experiencing the issue. N/A for a server issue if no sensor is installed. Please include versions of all endpoints impacted. This allows support to research and consider version-specific issues.
- Number of sensors impacted: The number of endpoints that are experiencing the issue. Determining the impact of the issue can direct troubleshooting and issue resolution.
- OS of the impacted endpoints: OS version—including flavor and kernel version for Linux—of the endpoints having the issue. This allows support to research and consider OS specific issues.
- Issue start time: Approximate date/time the issue began. This helps support the review the logs and correlate data across logs at the time of the issue.
- Issue Description: This section should be documented with activity on the endpoint that lead to the issue after you have worked with your customer to reproduce the issue if possible. Note: It is understood there are situations that cannot be replicated for various reasons. Description should in your words depict the issue as you witnessed it.
-
Outside of Carbon Black products, are there additional security products installed on the endpoints? Are any other security applications, including Windows Defender, running on the endpoint? Security products have a high rate of interop issues. Exclusions are the first step in ruling out many performance, unexpected block, and interop cases. Indicate yes or No, Sensor related issues require a yes or now answer.
- Are AV exclusions in place, verified to be correct, and latest recommended: If the answer in question 12 was no, this question is N/A.
- If AV exclusions have been verified are they the most current recommended exclusion: If there is another AV installed, double-check the exclusions in place and verify that they are correct and the latest recommendations per the third-party vendor. Carbon Black does not create or maintain a list of exclusions needed for 3rd party products as they may change over time. If (No) in question 12 this question is N/A
- Keywords searched in the User eXchange: Any words/phrases used to search for KB’s in the User eXchange prior to opening the case. Per MSSP agreements, Partner teams are required to exhaustively leverage all documentation and resources to resolve Level 1 and Level 2 issues before raising a case with VMWare Carbon Black Support.
- Troubleshooting steps performed so far: Brief summary of the investigation to date as well as what is needed from VMWare Carbon Black support to help resolve the case. Per MSSP agreements, partner support teams are required to attempt to troubleshoot Level 1 and Level 2 issues before raising a case with VMWare Carbon Black Support. Any and all information from L1 and L2 troubleshooting should be relayed here to expedite case handling beyond the L1/L2 troubleshooting attempted by the partner support team.
- Logs Collected: What logs have been collected to date, and have they been uploaded to the User eXchange? Per MSSP agreements, partner support teams are required to attempt to troubleshoot Level 1 and Level 2 issues before raising a case with VMWare Carbon Black Support. Level 1/Level 2 troubleshooting activities completed by partners should include collecting and reviewing logs. Cases opened without required logs will result in troubleshooting delays while the customer and partner collect the required information. A customer not having (repcli) configured or (repcli) access is not a reason to omit required logs.
- Log Findings from partner review: Any errors discovered in the logs by the partner’s support team should be listed here.
Additional Notes
- The information in this template is utilized by Support to determine customer environments, whether any of our components are out of support, and to determine proper troubleshooting processes.
- This allows the Partner Support team to determine whether Supporting Partners are complying with their obligations to fulfill Level 1 and Level 2 troubleshooting for their clients.
- Failure to provide this information delays Support to provide case resolution.
Related Content
