Skip to main content

Case assigned

  • August 9, 2024
  • 1 reply
  • 12 views

Forum|alt.badge.img+2

when we ingest alert in Soar it automatically get assigned to Tier-1 , can we make it to Unassigned 

basically assigned to no one 

 

1 reply

mccrilb
Forum|alt.badge.img+12
  • Silver 2
  • August 12, 2024

you could do this a few ways. What I did was to create a role called "Ingest Playbooks" with no users in it and all cases that come in are assigned to that. At the end of the ingest playbooks I assign the case to a stage (phishing as an example) and assign it to the role with the group of users that are intended.

With doing that, I do have to watch the cases to be sure nothing gets stuck there. Weekend patching as an example.