1. Executive Summary
This framework defines the competency roadmap, scope boundaries, and operating model for onboarding our new business partner into Level 1 (L1) and Level 2 (L2) technical support for the Sestek Conversational Analytics platform.
Support is strictly scoped to technical and infrastructure problems — service availability, data-pipeline health, integration errors, and performance — and explicitly excludes product usage, configuration walkthroughs, and business-analytics interpretation, which remain with Sestek's Product and Professional Services teams.
Because the partner's engineers already bring general IT/support experience (Linux, networking, ticketing discipline, structured troubleshooting), the first 90 days concentrate on three things: (1) Sestek product/data-flow architecture, (2) hands-on proficiency in the Elastic Stack — Elasticsearch, Kibana, and APM — and (3) Sestek-specific escalation discipline. The partner progresses from supervised L1 triage to independent L1+L2 ownership through three certification checkpoints at Day 30, Day 60, and Day 90.
The framework also establishes the escalation matrix, KPI/SLA targets and the governance cadence needed to keep quality consistent after go-live.
2. Purpose & Objectives
The objectives of this framework are to:
• Establish a shared, measurable competency bar before the partner takes ownership of live customer tickets.
• Give the partner a clear, unambiguous boundary of what is and is not in their remit, preventing scope creep into product-usage support.
• Provide a time-boxed (30-60-90 day) path to independence, backed by certification checkpoints, so hand-off is criteria-based rather than calendar-based alone.
• Define escalation and SLA discipline so tickets reach the right tier quickly, minimizing MTTR (mean time to resolution) for end customers.
• Produce KPI baselines, and a governance cadence that sustains quality after go-live.
3. Scope of Support
3.1 In Scope — Technical Support (L1/L2)
• Service and pipeline availability incidents across ingestion, speech-to-text (ASR), NLP/text analytics, indexing, and dashboard rendering stages.
• Elasticsearch cluster health issues: cluster/index status, shard allocation problems, node and resource health, JVM/heap pressure.
• Kibana technical failures: dashboards/visualizations not rendering, broken saved searches, access/authentication errors (not “how do I build a dashboard”).
• APM-flagged performance issues: latency spikes, elevated error rates, service timeouts, throughput drops, degraded transaction traces.
• Integration / API failures with upstream systems (telephony platforms, CRM, data feeds, webhooks).
• Infrastructure alerts: CPU/memory/disk thresholds, container or pod crashes and restarts, network connectivity issues between microservices.
• Data completeness and backfill issues (missing, delayed, or duplicated data in indices).
• Log-based root cause analysis via Kibana Discover, Elasticsearch queries (Query DSL / Dev Tools), and APM traces.
3.2 Out of Scope — Remains with Sestek Product / Customer Success
• How to use the product: building or customizing dashboards, reports, taxonomies, or business rules.
• Interpreting analytics results, business insights, or KPI methodology questions.
• Licensing, user provisioning, and commercial/contractual questions.
• Feature requests, enhancement ideas, and product roadmap questions.
• End-user training on product features and workflows.
3.3 Grey-Zone Routing Rule
Note: Use this quick test at ticket intake: if the question is “why is the system not doing X” (a technical/system fault), it is Support (L1/L2) scope. If it is “how do I do X” (a usage/configuration question), route it to Product/Professional Services. Ambiguous tickets default to a 15-minute L1 technical check first — if no technical fault is found, re-route to Product/CS with the diagnostic notes attached.
4. Support Tier Model
4.1 Overview
| Tier | Owner | Mission | Typical Role |
|---|---|---|---|
| L1 — Front-Line | Business Partner | Rapid triage, known-issue resolution, evidence collection. | First point of contact for all technical tickets. |
| L2 — Advanced | Business Partner | Deep root-cause analysis using the Elastic Stack and APM, cross-service correlation, safe remediation. | Escalation destination for tickets L1 cannot resolve within SLA. |
| L3 — Engineering | Sestek- Application Support and Software Development Teams | Code-level fixes, architecture changes, vendor/Elastic-level escalation. | Final escalation tier; not partner-staffed. |
4.2 L1 Responsibilities — Business Partner
• Receive, log, and triage all inbound technical tickets; assign severity (S1–S4) per the escalation matrix (Section 8).
• Perform first-level health checks: service status pages, uptime/heartbeat checks, pipeline stage status ( Only for on-prem)
• Restart designated services or jobs strictly per approved, documented procedures where access has been granted.
• Collect a complete diagnostic bundle (logs, timestamps, affected environment/tenant, screenshots, reproduction steps) before any escalation.
• Own customer/partner-facing communication on ticket status within SLA windows.
• Escalate to L2 when root cause is not evident within the L1 SLA window or the fix requires access/knowledge beyond L1 scope.
4.3 L2 Responsibilities — Business Partner
• Perform deep root-cause analysis using Elasticsearch Query DSL / Dev Tools and APM transaction traces, service maps, and latency breakdowns.
• Correlate logs and traces across pipeline stages (ingestion → ASR → NLP → indexing → dashboard).
• Diagnose Elasticsearch cluster health in depth: shard status, node health, JVM heap/GC behavior, index lifecycle issues.
• Diagnose infrastructure-level issues: container/pod crash loops, resource constraints, inter-service network faults ( Only for on-prem)
• Apply advanced remediation within approved boundaries: index/reindex operations, cache clearing, service scaling, configuration tuning.
• Coordinate data-pipeline backfill or replay for missed or delayed data.
• Escalate to Sestek L3 for confirmed code defects, undocumented product behavior, or fixes requiring a product change — with a complete RCA package if possible.
4.4 What a Good L2 → L3 Escalation Package Contains
• Problem statement, business impact, and affected tenant(s)/environment(s).
• Timeline of the incident with timestamps in UTC and local time.
• Relevant Kibana/Elasticsearch queries used, with links or exported results.
• APM trace IDs / transaction samples showing the anomaly.
• Steps already attempted and their outcomes (ruling out known causes).
• Hypothesis of root cause and why L2 believes it requires engineering involvement.
5. Competency Framework
The framework below defines the target competencies for each domain, at each tier, that the partner's engineers must demonstrate to be certified. It is the basis for the training curriculum in Section 6 and the assessment checkpoints in Section 7.
| Competency Domain | L1 Target Competencies | L2 Target Competencies |
|---|---|---|
| A. Product & Data-Flow Architecture | - Understands end-to-end pipeline: ingestion → ASR → NLP → indexing → dashboard. -Can identify which stage a symptom belongs to. - Knows in-scope vs. out-of-scope boundary (Section 3). | - Deep knowledge of each microservice's role, inputs/outputs, and dependencies. - Can trace a single interaction record across every pipeline stage. - Understands data retention, index lifecycle, and multi-tenant isolation. |
| B. Linux, Networking & Containers | - Comfortable with shell, log file navigation, basic networking (DNS, ports, connectivity tests). - Can read container/pod status and basic logs. | - Diagnoses container crash loops, resource limits, and inter-service network faults. - Comfortable with orchestration-platform commands relevant to the granted access scope. |
| C. Elasticsearch | - Understands indices, documents, shards, and mappings conceptually.- Can run queries via Kibana to check for known error signatures. | - Writes and adapts Query DSL in Dev Tools for RCA. - Reads cluster health APIs; diagnoses yellow/red status, unassigned shards and index lifecycle problems. |
| D. Kibana | - Navigates Discover, Dashboards, and saved searches confidently.- Applies filters/time-range controls to isolate an incident window. | - Builds ad-hoc diagnostic visualizations for RCA. - Troubleshoots dashboard/visualization rendering failures at a technical (not content) level. |
| E. Elastic APM & Observability | - Reads service-health overview and recognizes an active alert. - Understands basic terms: transaction, span, trace, error rate, latency. | - Analyzes distributed traces and service maps to isolate the failing service/dependency.- Correlates APM signals with Elasticsearch/infrastructure findings to confirm root cause. |
| F. Incident, Ticketing & Documentation | - Logs, categorizes, and prioritizes tickets accurately per the severity model. - Correlates logs to make some reasonable conclusions | - Writes clear RCA reports - Assembles complete, high-quality L3 escalation packages. |
| G. Communication & Escalation Discipline | - Provides clear, timely status updates within SLA. - Knows exactly when and how to escalate to L2. | - Manages stakeholder communication during multi-hour incidents. - Makes sound escalate-vs-resolve judgment calls to L3, avoiding both over- and under-escalation. |
6. 30-60-90 Day Onboarding Roadmap
The roadmap assumes the partner's engineers already have general IT/support experience (Linux, networking, ticketing, structured troubleshooting). Time is therefore concentrated on Sestek product architecture, the Elastic Stack, and escalation discipline rather than on general IT fundamentals.
6.1 Phase 1 (Days 1–30): Foundation & L1 Enablement
| Period | Focus Area | Key Activities | Deliverable / Milestone |
|---|---|---|---|
| Foundations & access | - Company/product overview; conversational-analytics pipeline walkthrough.- Access provisioning: VPN/bastion, Kibana, ticketing tool, any documentation. - Support scope briefing (Section 3) and data-privacy/security briefing. - SLA policy and severity model training (Section 8). | Access verified; | |
| Elastic Stack fundamentals | - Elasticsearch concepts: indices, documents, shards, mappings. - Kibana navigation: Discover, Dashboards, saved searches, Dev Tools basics. - Hands-on labs against a sandbox environment with sample data. | Sandbox lab exercises completed. | |
| Supervised ticket handling | - Partner handles L1 tickets; Sestek engineer reviews before closure. - Daily debrief on triage accuracy and diagnostic quality. - Checkpoint 1 preparation: written + practical review. | → Day 30 Checkpoint: L1 |
6.2 Phase 2 (Days 31–60): L1 Independence & L2 Foundation
| Period | Focus Area | Key Activities | Deliverable / Milestone |
|---|---|---|---|
| L1 independence begins | - Partner owns the L1 queue independently; - L2 curriculum starts: APM fundamentals — transactions, spans, traces, service maps. | L1 KPI dashboard live; APM lab #1 complete | |
| Elasticsearch operations deep dive | - Cluster health APIs; diagnosing yellow/red status and unassigned shards.- Index lifecycle management (ILM) concepts. | Cluster-health lab exercise completed. | |
| Pipeline & infrastructure deep dive | - Deep dive on ingestion, ASR, NLP, and indexing microservices.- Container/orchestration operations relevant to granted access: logs, restarts, resource limits. | Pipeline-tracing lab exercise completed. | |
| L2 shadowing & mid-point review | - Shadow Sestek L2 engineers on real escalations.- Begin co-owning selected L2 tickets under supervision.- Mid-program KPI and competency review. | → Day 60 Checkpoint: L2 |
6.3 Phase 3 (Days 61–90): L2 Independence & Optimization
| Period | Focus Area | Key Activities | Deliverable / Milestone |
|---|---|---|---|
| Supervised L2 ownership | - Partner handles L2 tickets with a Sestek engineer on standby for validation.- Escalation-calibration workshop: case studies on when to resolve at L2 vs. escalate to L3. | 2+ L2 tickets independently resolved and reviewed. | |
| Incident simulation | - S1 major-incident simulation drill (e.g., simulated cluster outage or pipeline halt).- End-to-end test of detection, triage, escalation, and stakeholder communication. | Simulation debrief and gap-closure actions. | |
| Full independent operation | - Partner runs L1 and L2 queues independently; Sestek shifts to periodic audit/spot-check mode. - Alerting/dashboard ownership handover finalized. | Audit findings closed. | |
| Final sign-off | - Final certification assessment (written + live-ticket review). - Formal program sign-off and go-live announcement. - Transition to steady-state governance cadence | → Day 90 Checkpoint: Full |
7. Escalation Matrix
Severity is assigned at intake by L1 and may be revised by L2 as more information emerges. Response time is the target for first meaningful contact/triage; resolution time is the target for closing or downgrading the incident. Chart is for premium 7*24 support service
| Severity | Definition | Response SLA | Resolution SLA | Escalation Path |
|---|---|---|---|---|
| S1 — Critical | The production system is having a significant enough impact on the Customer’s business function to prevent that function from being executed. Most of the users can not use the system to do their routine work. At least %80 of users are affected. | ≤ 2 Hours | ≤ 36 business hrs | Immediate to L2 if unresolved in 4 Hours ; L2 → L3 within 8 Hours if root cause not found. |
| S2 — Significant | The production system or application is moderately affected. There is no workaround currently available, or the workaround is cumbersome to use. There are some technical malfunctions in the system that affects %25 of the users at most. | ≤ 4 Hours | ≤ 7 business days | L1 → L2 within 1 business day if unresolved; L2 → L3 within 2 business days if root cause not found. |
| S3 — Normal | The production system or application issue is not critical; no data has been lost, and the system has not failed. The issue has been identified and does not hinder normal operations, or the situation may be temporarily circumvented using an available workaround. | ≤ 8 hrs | ≤ 30 Business Days | L1 → L2 within 4 business day if unresolved. |
| S4 — Low | Cosmetic issue or non-urgent technical inquiry; no material customer impact. | N/A | Next Version | Escalate only if investigation reveals broader impact. |
7.1 Escalation Channels
• S1/S2: dedicated Sestek–Partner incident channel (Teams) plus hotline for S1.
• S3/S4: standard ticketing-system escalation with the diagnostic bundle attached.
• Every escalation must include the diagnostic bundle described in Section 4.4 — escalations without it are returned to the originating tier for completion, which itself should be tracked as a quality metric.
8. Roles & Responsibilities (RACI)
R = Responsible, A = Accountable, C = Consulted, I = Informed.
| Activity | Partner L1 | Partner L2 | Sestek L3 (App Support&SW Dev) | Sestek Product/PS |
|---|---|---|---|---|
| Ticket intake & triage | R/A | C | I | I |
| L1 known-issue resolution | R/A | I | I | - |
| L2 root-cause analysis | C | R/A | I | - |
| Code-level fix / product change | I | C | R/A | C |
| Escalation to L3 | C | R/A | A | - |
| Product-usage / configuration questions | I | I | - | R/A |
| KPI reporting & governance review | C | C | I | I |
| Major incident (S1) communication | R | R/A | C | C |
9. Tools & Access Requirements
Access is provisioned progressively: L1 access is granted at onboarding start; L2 access (query write, on-call) is granted only after the Day 60 L2 Readiness checkpoint. All access follows least-privilege and is reviewed quarterly.
| Tool / System | Purpose | L1 Access Level | L2 Access Level |
|---|---|---|---|
| Kibana | Log/dashboard investigation, saved searches for triage. | Read-only, scoped index patterns/dashboards | Read + Dev Tools query access |
| Elasticsearch (Dev Tools / APIs) | Direct querying and cluster-health checks for RCA. | None (uses Kibana saved searches only) | Read; limited write for approved remediation (e.g., ILM actions) |
| Elastic APM | Trace, service-map, and latency/error analysis. | Read-only, service overview | Full read; trace drill-down |
| Ticketing System | Ticket intake, triage, SLA tracking, escalation. | Full | Full |
| Knowledge Base or any documentation | Documented fixes and RCA history. | Read; suggest edits | Read/write |
| VPN / Bastion Access | Secure access to environments. | Scoped to non-production / designated support environment | Scoped to production diagnostics per access policy |
| Incident Communication Channel | Real-time coordination during S1/S2 incidents. | Member | Member |
| Alerting / On-call | Tool Notification of active incidents. | Not on-call by default | On-call rotation once certified (Day 60+) |
10. Governance & Continuous Improvement
• Weekly sync between Sestek and partner leads during the first 90 days to track roadmap progress and unblock issues.
• Quarterly KPI review
• Yearly refresher training (if needed)
• Structured feedback loop from L3 back to L1/L2 documentation whenever a new root cause is confirmed, so the same issue is resolvable at a lower tier next time.
• Sestek notifies the partner of planned product/infrastructure changes ahead of releases, with an impact note on what L1/L2 should expect to see.
Appendix A: Glossary
| Term | Definition |
|---|---|
| ASR | Automatic Speech Recognition — converts voice/audio into text. |
| NLP | Natural Language Processing — extracts meaning, sentiment, topics, and entities from text. |
| Elastic Stack / ELK | Elasticsearch, Logstash, and Kibana (plus Beats/APM) — the search, ingestion, and visualization platform used for troubleshooting. |
| APM | Application Performance Monitoring — Elastic's distributed tracing and service-performance tool. |
| RCA | Root Cause Analysis — the investigation process to find the underlying cause of an incident. |
| MTTR | Mean Time to Resolution — average time from incident detection to resolution. |
| SLA | Service Level Agreement — the committed response/resolution time targets. |
| Shard | A partition of an Elasticsearch index; clusters distribute shards across nodes for scale and resilience. |
| Index Lifecycle Management (ILM) | Elasticsearch feature that automates rollover, retention, and deletion of indices over time. |
| S1–S4 | Severity levels used in the escalation matrix (Section 8), from Critical (S1) to Low (S4). |