topic XSOAR Shift Management and Incident Assignment in Cortex XSOAR Discussions

XSOAR Shift Management and Incident Assignment

JoshBoyd — Tue, 08 Aug 2023 20:26:14 GMT

I've read a little about the Shift Management function.

Does this allow for intelligence to auto-assign incidents?

Example:
5 people on shift, based on threshold of SLA, auto-assign incident round robin style to the analyst that are in the queue?

Is there anything like that out of the box?

Re: XSOAR Shift Management and Incident Assignment

MBeauchamp2 — Wed, 09 Aug 2023 13:34:07 GMT

It's kind of intelligent, you can use the AssignAnalystToIncident automation with the onCall=true argument which will randomly assign an Analyst who is on shift. It's not round robin however, it's random.

I myself prefer using a queue system, and using the Time to Assignment timer to handle things that don't get picked up, talked about it in the Case Management Webinar back in February:

https://live.paloaltonetworks.com/t5/customer-success-webinars/cortex-xsoar-customer-success-webinar-case-management/ta-p/532014

If you wanted to reassign on SLA breach then you'd need to look into writing an SLA breach script that performs that action:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Customize-SLA-Scripts

There is a video on these in the training series as well (video 18):

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success-engineering-training-video/ta-p/484604

Re: XSOAR Shift Management and Incident Assignment

JoshBoyd — Wed, 09 Aug 2023 14:55:43 GMT

Thanks for the quick response and the content...will review.

Thanks!