- Case Manager Release Notes
- Get Started with Case Manager
- Configure Case Manager Settings
- Investigate a Security Incident
Case Manager Queues
Effectively manage a shared workload and organize your team with queues.
A queue is a designated group responsible for investigating an incident. Every incident is assigned a queue. If you're in a queue assigned to an incident, you're responsible for working on the incident. Track the incidents your queue is assigned to with the Incidents in My Queues watchlist. The incident remains assigned to your queue until someone closes the incident or assigns it to another queue.
By default, everyone is in the Unassigned Queue. Create new queues that better fit your needs. You might create queues based on SOC tiers (tier 1, tier 2, and tier 3) or a 24-7 service model. You can also edit or delete a queue you create.
Keep in mind that assigning an incident to a queue only indicates who is responsible for investigating the incident; it doesn't restrict access to the incident to that queue only. To restrict who can access an incident, edit an incident's Restrict To settings.
Create a Case Manager Queue
To assign Case Manager incidents to a group of people, create a queue.
In the sidebar, click SETTINGS
, then select Core.Under QUEUES, click Queues.
Click Add a new queue
.Enter a name for the queue.
(Optional) Describe the queue.
Add people to the queue:
To add specific people, click + next to the person's name. To quickly find and add a person, start typing in the search.
To add everyone in the system, click ADD ALL.
Click CREATE QUEUE.
In the sidebar, click SETTINGS
, then select Core.Under QUEUES, click Queues.
Hover over a queue, then click Edit Queue
.Edit the name, description or people in the queue.
Click SAVE QUEUE.
In the sidebar, click SETTINGS
, then select Core.Under QUEUES, click Queues.
Hover over a queue, then select Delete Queue
.Click DELETE.