- Case Manager Release Notes
- Get Started with Case Manager
- Configure Case Manager Settings
- Investigate a Security Incident
- Manually Create an Incident
- Edit an Incident
- Delete an Incident
- Manually Add an Entity
- Manually Add an Artifact
- Delete an Entity or Artifact
- Add Advanced Analytics Evidence to a Case Manager Incident
- Manage Tasks During an Investigation
- Send Messages from an Incident
- Filter Incidents
- Search for an Incident
- Sort Incidents
- Export Incidents
Case Manager Queues
Effectively manage a shared workload and organize your team with queues.
A queue is a designated group responsible for investigating an incident. Every incident is assigned a queue. If you're in a queue assigned to an incident, you're responsible for working on the incident. Track the incidents your queue is assigned to with the Incidents in My Queues watchlist. The incident remains assigned to your queue until someone closes the incident or assigns it to another queue.
By default, everyone is in the Unassigned Queue. Create new queues that better fit your needs. You might create queues based on SOC tiers (tier 1, tier 2, and tier 3) or a 24-7 service model. You can also edit or delete a queue you create.
Keep in mind that assigning an incident to a queue only indicates who is responsible for investigating the incident; it doesn't restrict access to the incident to that queue only. To restrict who can access an incident, edit an incident's Restrict To settings.
Create a Case Manager Queue
To assign Case Manager incidents to a group of people, create a queue.
In the sidebar, click SETTINGS
, then select Core.Under QUEUES, click Queues.
Click Add a new queue
.Enter a name for the queue.
(Optional) Describe the queue.
Add people to the queue:
To add specific people, click + next to the person's name. To quickly find and add a person, start typing in the search.
To add everyone in the system, click ADD ALL.
Click CREATE QUEUE.
In the sidebar, click SETTINGS
, then select Core.Under QUEUES, click Queues.
Hover over a queue, then click Edit Queue
.Edit the name, description or people in the queue.
Click SAVE QUEUE.
In the sidebar, click SETTINGS
, then select Core.Under QUEUES, click Queues.
Hover over a queue, then select Delete Queue
.Click DELETE.