Working the alerts queue
What untriaged means, and the three things that move a case out of the queue.
The Alerts page has two tabs. Untriaged is the working queue and opens by default. Triaged is everything else.
In the queue
Opened
Critical severity· Elliptic 9/10
Triggered rule: Counterparty on a sanctions list
Counterparty on a sanctions list
Summary
- Subject
- Priya Raman · 0x4f2a…c019
- Type
- Address · Ethereum
- Received
- Alert ID
- ELP-4471-9930-1182
Case
- Case
- CASE-2871 · Priya Raman
- Grouped by
- Same subject wallet
- Other alerts
- 1 on this case
Customers
1- Priya RamanKYC passedHolds the alert's subject wallet · as captured
The data here is invented.
The row names the case the alert grouped onto, so you can tell before you open it whether somebody is already working one.
Both tabs list cases rather than alerts, because an alert always sits on one.
What untriaged means
A case is untriaged when all three of these hold: it is open, nobody owns it, and nobody has recorded a decision on it. It is a case nothing has happened to yet.
Working through it
- 1
Open the case from the queue
The agent has usually already investigated, so the case opens with findings and a recommendation on it.
- 2
Assign it to yourself if you are going to work it
This alone takes it out of the untriaged queue, so nobody else picks up the same case.
- 3
Decide, or assign it to somebody else
Any of the five outcomes moves the case out of the queue, including the three that keep it open.
A case you put on hold is triaged. Somebody looked at it and recorded a decision, which is what the queue tracks. It still shows on your own case list.
Related
Last checked against the product on .