Case study · Managed IT services
Four sources in, one report out, for every customer.
SLA tracking and per-customer reporting for an IT MSP.
Free · 30 minutes · No pitch. Ask me about work like this.
- 4 sourcesto1 report monitoring, ticketing and SOC data
- By handto0 h of on-call tallying; hours come from the incident itself
- AssembledtoScheduled every customer’s report, delivered to Teams and SharePoint
- ScatteredtoOne stack Telegraf, InfluxDB and Grafana inside each customer network
Diagram · How a report builds itself
Each customer network ×N
- Telegraf
- InfluxDB
- Grafana
One TIG stack per customer, nothing exposed
Reverse VPN
Central report server
- Queries each customer database on a schedule
- Renders report images and metrics
- + SOC SLA metrics from AlienVault / LevelBlue
Delivered
Where account managers work
- Microsoft Teams
- SharePoint
Same report, same schedule, every customer
Alongside PagerDuty → ticketing sync over webhooks and REST. Hours per responding engineer come from the incident itself.
The short version
An IT MSP relied on four separate sources and hand-built reports to prove its service levels. I replaced them with a PagerDuty sync and one server that builds every customer’s report. It now delivers each report into Teams and SharePoint, with zero hours of on-call tallying by hand.
At a glance
What changed, line by line.
| Before | After | |
|---|---|---|
| Customer reports | Assembled by hand from four sources | Rendered per customer on a schedule, delivered to Teams and SharePoint |
| On-call time | Tallied separately from the incidents it belonged to | Hours per responding engineer, calculated from the incident itself |
| Monitoring | Scattered across customer networks | A Telegraf, InfluxDB and Grafana stack per customer, over reverse VPN |
| SOC metrics | In a separate portal | Pulled from AlienVault / LevelBlue into the same report |
Four sources, and a report built by hand.
A managed service provider had to prove service levels to every customer it supported and had no reliable way to do it. Monitoring data was scattered across customer networks, the ticketing system held the work, PagerDuty held the alerts, and the SOC metrics lived in a separate portal.
Customer reports were assembled by hand from those sources, and on-call time was tallied separately from the incidents it belonged to.
One pipeline, from each network to Teams.
A PagerDuty to ticketing sync, built on webhooks and REST APIs, so on-call incidents create and update their own time records, with the hours per responding engineer calculated from the incident itself.
Each customer got a TIG stack, Telegraf, InfluxDB and Grafana, inside their own network, reachable over a reverse VPN so nothing had to be exposed. A central server queries each customer’s database on a schedule, renders per-customer report images and metrics, and delivers them into Teams and SharePoint where the account managers already work.
SOC service-level metrics are pulled from AlienVault, now LevelBlue, and merged into the same reports, so one document covers infrastructure and security together.
The result: one report, and nobody assembling it.
Every customer gets the same report, on the same schedule, without anyone assembling it, delivered where the team already works.
On-call time is recorded from the incidents as they happen, with no separate tally. Monitoring, ticketing and SOC data describe the same month in one report.
One monitoring stack inside every customer network. One report per customer, on schedule, into Teams and SharePoint, with on-call hours recorded as each incident happens.
The same pattern works for any business that reports monthly from ticketing, accounting or a CRM.
Keep reading
Next case study
Case study 01 / 03
2016toGone the server that ran everything, retired
HVAC manufacturer’s rep · New York City · 20 staff
Independent consultant · MikeG 3D LLC
The 2016 server is gone, and one system carries a job from quote to commission.
- Before
- One 2016 server on its original drives, a firewall portal open to the internet, and no one on 2FA.
- After
- Microsoft 365 and Entra ID, a hardened edge, off-site backups, and one application from quote to commission report.
