Documentation Case Manager Queues
Effectively manage a shared workload and organize your investigation with queues.
A queue is a designated group responsible for investigating an incident. Every incident is assigned a queue. If you're in a queue assigned to an incident, you're responsible for working on the incident. Track the incidents your queue is assigned to with the Incidents in My Queues watchlist. The incident remains assigned to your queue until someone closes the incident or assigns it to another queue.
By default, everyone is in the Unassigned Queue. Create new queues that better fit your needs. You might create queues based on SOC tiers (tier 1, tier 2, and tier 3) or a 24-7 service model.
You can edit or delete a queue you created.
Create a Queue
To assign incidents to a group of people, create a queue.
In the navigation bar, click the menu
, select Settings, then select Core.Under QUEUES, click Queues.
Click Add a new queue
.Enter a name for the queue.
(Optional) Describe the queue.
Add people to the queue:
To add specific people, click + next to the person's name. To quickly find and add a person, start typing in the search.
To add everyone in the system, click ADD ALL.
Click CREATE QUEUE.
In the navigation bar, click the menu
, select Settings, then select Core.Under QUEUES, click Queues.
Hover over a queue, then click Edit Queue
.Edit the name, description or people in the queue.
Click SAVE QUEUE.
Delete a Queue
If you created a queue, you can delete it. Any people and incidents assigned to the queue are reassigned to the default Unassigned queue.
In the navigation bar, click the menu
, select Settings, then select Core.Under QUEUES, click Queues.
Hover over a queue, then select Delete Queue
.Click DELETE.