XSOAR Shift Management and Incident Assignment

[JoshBoyd]

I've read a little about the Shift Management function.

Does this allow for intelligence to auto-assign incidents?

Example:
5 people on shift, based on threshold of SLA, auto-assign incident round robin style to the analyst that are in the queue?

Is there anything like that out of the box? 

[MBeauchamp2 · Accepted solution]

It's kind of intelligent, you can use the AssignAnalystToIncident automation with the onCall=true argument which will randomly assign an Analyst who is on shift.  It's not round robin however, it's random. 

I myself prefer using a queue system, and using the Time to Assignment timer to handle things that don't get picked up, talked about it in the Case Management Webinar back in February: 

https://live.paloaltonetworks.com/t5/customer-success-webinars/cortex-xsoar-customer-success-webinar... 

If you wanted to reassign on SLA breach then you'd need to look into writing an SLA breach script that performs that action:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Custom...

There is a video on these in the training series as well (video 18):

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success... 

[JoshBoyd]

Thanks for the quick response and the content...will review.


Thanks!