FireSight docsEmergency changes
An emergency change is approved by the emergency chain alone, so it can be deployed straight away. The normal chains then review it once it is live, within a deadline. Use it only for outages and security incidents.
Emergency changes are off until an administrator turns them on.
Turn emergency changes on
An administrator needs two things:
- Settings, Policies & schedules, Approvals: tick Allow emergency changes, and set Emergency review deadline (hours) (default 72, from 1 to 720).
- Settings, Approval chains: an emergency chain that is on and has at least one stage that is on. FireSight creates one called Emergency change with one stage, Duty security approval (Security). There can be only one emergency chain. See Approval chains.
Raise an emergency change
- Create the request as usual. See Create a rule request.
- Under Why it's needed, tick This is an emergency change. The box explains: approved by the emergency chain only, reviewed by the normal approvers within the deadline, who can ask for it to be backed out.
- Fill in Why it can't wait (at least 10 characters). Approvers and reviewers see this.
- Click Confirm and submit as an emergency.
The request is tagged Emergency in lists, and its page shows Emergency change. with the reason.
Approval, deployment and review
| Phase | Who | What happens |
|---|---|---|
| Emergency approval | The emergency chain's stages | Approving every stage approves the request. |
| Deployment | An implementer who didn't request or approve it | As any deployment. The review opens when it is deployed. |
| Review after deployment | The chains the request would normally go to (its management domains' chains and conditions) | Each stage is decided in order, per chain. The review is due Emergency review deadline (hours) after deployment. |
The request page's Approval and review panel shows both phases. Before deployment, the review reads starts when it's deployed; afterwards it shows due with the date, and (overdue) in red once the deadline passes.
Reviewers must be different people
Reviewers can't be anyone who approved the emergency change or deployed it: you approved this emergency change, so someone else must review it and you deployed this emergency change, so someone else must review it.
Approve or reject in review
Reviewers see the request on their Approvals page. The buttons read Approve review and Reject in review.
- When every review stage is approved, the page says The review approved it.
- A rejection in review doesn't remove the change: it is already live. The request shows The review rejected this emergency change. It is still live. An implementer should back it out, or the requester should raise a normal request to keep it., and lists show Review rejected. Remaining review stages are marked skipped.
If emergency changes are turned off
If an administrator turns emergency changes off, or switches off or deletes the emergency chain:
- nobody can submit an emergency change;
- emergency changes already waiting can't be approved, and approved ones that haven't been deployed can't be deployed. Cancel them and submit them as normal changes.
Changes already live are unaffected, and their reviews continue.