Tuesday And Wednesday Are The Busiest For NetOps/SecOps Teams
Notice: This blog post was originally published on Indeni before its acquisition by BlueCat.
The content reflects the expertise and perspectives of the Indeni team at the time of writing. While some references may be outdated, the insights remain valuable. For the latest updates and solutions, explore the rest of our blog
This article analyzes alert volume from indeni Insight for customers between March 9 and April 5, 2015, finding that alerts cluster by day of week and identifying Tuesday and Wednesday as the busiest days for network and security operations teams. It explains the operational rationale that many alerts are triggered by configuration changes, so higher alert counts indicate periods of increased change activity and potential operational risk. The piece suggests monitoring trends over time to validate whether these mid-week peaks persist and to inform staffing and change-management planning.
Why does the article consider days with the most alerts to be the busiest for network and security operations teams?
The article reasons that many indeni alerts are generated in direct response to configuration changes, and indeni’s role is to analyze configurations as they change and flag possible issues. Therefore, a higher number of alerts on particular days implies more configuration activity—and consequently more work—for operations teams handling those alerts. Using alert counts as a proxy for busyness links alert volume to operational load from managing changes and remediating detected issues.
What time period and dataset were used to determine which days are busiest?
The analysis covers all alerts indeni generated for customers connected to indeni Insight from March 9, 2015 through April 5, 2015. The dataset is grouped by the day of the week on which each alert was generated. The article references a graph of these results and notes that, as of April 7, 2015 (the date of writing), Tuesday and Wednesday appeared to have the highest alert volumes.
Does the article claim the busiest days will stay the same over time?
No, the article does not claim the pattern is permanent; it states it will be interesting to see if this changes over time and suggests that it probably shouldn’t change. The author encourages checking up-to-date results by clicking the image linked in the post, implying ongoing monitoring to confirm whether the mid-week peaks persist.
Network operations and security operations teams generally work around the clock. However, there are days and times they are clearly busier. Below is a graph that analyzes all of the alerts indeni generated for our customers (those connected to indeni Insight) over the course of Mar 9th 2015 to Apr 5th 2015, according to the day of the week they were generated. At the time of writing of this blog post (Apr 7th, 2015), it was clear that Tuesday and Wednesday are the busiest days. It will be interesting to see if this changes over time, which is probably shouldn’t. To get up-to-date results, click on the image itself.
The rationale behind claiming that the days with the most alerts are the busiest, is that a big portion of alerts issued by indeni are ones that are in direct response to a configuration change. Remember – our job is to analyze configurations as they change and alert when we find possible issues in them.