Routing
Loading…
AutomationA read-only overview for whoever leads the shift: the 24×7 work queue and how much of it needs a person, what the agents and automation are doing, and what the SOC has done. Cases are listed, ranked and worked in the worklist under Incidents; each work-queue tile opens it on the cases it counts.
Where cases go, what the agents run on their own, and the limits that keep it in check.
Data scopeApplies at once to the work-queue tiles, the Offered count, the arrivals chart and the agents pipeline here, and to the worklist under Incidents: the two tabs share one data scope. Automation failing, Under an SLA clock and the other tabs do not follow it.
What changed on this page
Automation is in the rail under Respond, next to Containment and Decisions. The thirteen collapsed sections of this page are six tabs: Overview, Routing, Investigations, Policy & shadow, Who a case reaches (moved here from the Relay card on the Agents page) and SOC activity. A link to the old page opens the tab that holds its section.
Controls sit in their own cards: the dispatch switch (the same platform-admin switch as the dispatch line, with its reason), the limits with History and Edit limits drawers, and the policy mode as an Off / Shadow switch that asks for a reason in a drawer.
Routing has queue tiles, role chips and a bulk bar that stays in view; Classify and Suppress ask for the reason in a drawer, and Suppress still shows the server’s preview and asks for the confirmation phrase.
Nothing was removed: every count, limit, history row and role rule is still here, one click deeper.
24×7 work queue
Loading the work queue…
Automatic dispatch
Loading…
Policy mode
Loading…
What agents are doing · last 7 days
click a stage to see what is behind itLoading what agents are doing…
Active incident arrivals · 7 days
Matching incidents by opening day, in the data scope above. A zero means no matching active incident was opened that day, not that collection was healthy.
Loading…
Needs a look
Loading…
Cases are listed and worked in the worklist under Incidents; raw signals arrive under Events.
Case routing
Loading…
Automated investigations
Loading…
The policy mode and its shadow outcomes. Only the platform admin and the CISO can see them (the CISO read-only); only the platform admin changes the mode, with a reason. The spend limits and the switch history of automatic dispatch are on the Overview's Automatic dispatch card.
Policy mode
Loading…
Shadow outcomes
Loading…
Loading…
What the SOC has done
Loading…