The Queue

The queue answers one question: which of my customers needs a human right now. It is the portal's front screen, and it is the same roster as the book, ordered worst first, with what each customer is carrying beside its name.

The book and the queue

The book is every customer you manage, worst first, with what each one is carrying at this moment. The queue is the day's triage list drawn from it, so a customer with nothing open is not in it.

Both read each estate as that customer's own account. A customer you hold no key for is named as ungranted rather than shown as empty, because the portal will not let an unread estate look like a quiet one.

Alerts, the change feed

Alerts is the feed of what the plane recorded across the whole book, newest first. Four lanes separate the kinds: incident, escalation, platform and notice. Tabs narrow the feed to what is active, what is snoozed, what is resolved, or everything at once.

Acknowledging, resolving and snoozing work in bulk, so a burst from one cause is handled in one pass. A suppression rule keeps a known source out of the feed instead of asking you to dismiss it repeatedly, and routing sends a customer's alerts to the people who cover that customer.

The states an alert moves through

An alert is open, acked, snoozed or resolved.

Acknowledging records that a person has it. Assigning names that person, and unassigning hands it back. A note records what you found without changing the state. Snoozing hides the alert until you reopen it. Reopening returns it to the active tab, and resolving closes it.

From triage to the work

The queue orders the day and stops there: the record of what was found and done lives in a case, which is what you open from an alert or a detection and what you eventually close.

Opening a customer from the queue takes you into their estate, with the detections behind their position in the list and the endpoints carrying them. An indicator worth chasing further than one estate goes to hunt.

One pass through the queue

A customer sits at the top because an endpoint there is carrying an open detection. You acknowledge the alert so nobody else picks it up, assign it to yourself, and open a case from the detection. You record in a note what the graph says about the destination the endpoint reached, dispatch a response verb from the case, and resolve the alert once the case carries the outcome. The customer's position in the queue falls as the estate stops carrying anything open.