Version:

Version:

Version:

Version:

Version:


Table of Contents

User Guide

Queue Management

Queues provide managers a view that answers questions like, "what are my resources working on currently?", "how many tasks are pending?", and "do any tasks require reallocation?". Queues provide users a view that answers questions like "what is my work?", "how much of my work is pending?", and "what is the priority of my tasks?".

FortiSOAR provides you with the Queue Management feature that provides you with an overview of work (records) that requires to be completed and enables you to assign pending work to users. You can also reassign assignments in case of absence or shift change.

Note

The Alerts, Incidents, and Tasks modules are added as default modules in Queue Management. You do not require to configure these modules for Queue Management.

Queue Management roles

Logical Role Description Minimum permissions required
Queue administrator The queue administrator has the rights to manage queues, including creating and deleting queues, assigning a queue leader and members and assigning tasks.
A queue administrator can also be a queue leader or a queue member.
Create, Read, Update, and Delete permissions on the System Assigned Queues module.
Queue leader A queue lead has similar rights to the queue administrator, except that the lead cannot create or delete queues.
A queue leader can also be a queue member.
Read and Update permissions on the System Assigned Queues module.
Queue member A queue member can view, assign, and remove the items from their queue. Read permissions on the System Assigned Queues module.
Note

To change the configurations or settings of queues, you must be assigned a role that has Create, Read, Update, and Delete (CRUD) permissions on the Application module and at the minimum Read permissions on the System Assigned Queues module.

Prerequisites to configuring queue management

To use queue management, follow the given steps to enable a module for queue management:

Note

The following procedure is an example of how you can enable a module for queue management. This procedure takes the example of the 'Alerts New' module. By default the Alerts, Incidents, and Tasks modules are added as default modules in Queue Management and therefore you do not need to add the System Assigned Queue to any of these modules.

  1. User must be assigned the role that has Create, Read, Update, and Delete (CRUD) permissions on the Application module and at the minimum Read permissions on the System Assigned Queues module.
  2. Click Settings and click Modules in the Application Editor section, to open the Module Editor.
  3. On the Modules page, from the drop-down list, select the module for which you want to enable queue management.
    For example, select Alerts New.
  4. Click the Fields Editor tab and click Add (+).
  5. Add the Properties for the field as follows:
    Field Type: Lookup (One to Many or One to One)
    Related Module: System Assigned Queues
    Field Title: System Assigned Queues
    Note: The Field API Key gets automatically populated as systemAssignedQueue.
    Properties for the System Assigned Queue field Click Save and Publish the module. Once the module has published, you are now ready to start configuring queue management.

Configuring queue management

  1. User must be assigned the role that has Create, Read, Update, and Delete (CRUD) permissions on the Application module and at the minimum Read permissions on the System Assigned Queues module.
  2. Click Queue Management in the left navigation bar.
  3. In the Unassigned Action Items pane, you can view the module (s) that have been enabled for queue management. See the Prerequisites section for information on how to enable a module for queue management. In our example, we can see the Alerts module.
    Note: The Alerts module is added as a default module in Queue Management, which does not require any configuration. The following images and steps are a representation of how you can configure any other module in Queue Management.
  4. To open the Queue Dashboard Module Configuration dialog, click the Settings (Settings icon) icon.
    Unassigned Action Item pane: Filter/Sorting Configuration
  5. On the Unassigned Items tab, click the module from which you want to assign items, for example, click Alerts. This displays the User Assignment Field in "Module Name" drop-down list in which select the field that is used in the module for assigning the record to a user. For example, select Assigned To.
    Note: By default, lookup fields in FortiSOAR display only the first 30 items. If you want to search for more than 30 items, please use the Search text box.
  6. In the Filter Criteria for Unassigned "Module Name" section, add a criterion that filters the User Assignment Field in the module (Alerts in our example) for unassigned records, i.e., set the User Assignment Field in "Module Name" field to (Assigned To" in our example) to null, as shown in the following image:
    Unassigned Item Configuration tab
    Also, in the Card Marker in "Module Name" drop-down list, select the criteria based on which you that you want to display the marker beside the unassigned items. You can choose between Severity, Status, and Type. For example, if you select Severity as the criteria, markers are displayed beside the unassigned alerts, so that users can immediately know the items that they need to prioritize.
    The nested filter component is also added to the Unassigned Items and Assigned Items tabs, allowing you to filter these items. For more information about nested filters, see the Dashboards, Templates, and Widgets chapter.
    Note: You cannot apply filters to encrypted fields.
  7. Click the Assigned Items tab, click the module from which you want to assign items, for example, click Alerts. This displays the Filter Criteria for Queue "Module" section to add a criterion that filters records that specifies the field and state to determine that the task (record) is not completed, and therefore should be added to the queue. For example, for the Alerts module, specify that the Status field of the record is not Closed, as shown in the following image:
    Queue Items Configurations tab
  8. (Optional) In the Default Sort For Queue <Name of the module> section, you can specify the sorting criteria for records in the queue. For example, for the Alerts module, specify that the records should be sorted on Severity in the descending order.
  9. Click Save.

Creating and deleting queues

  1. To create a new queue, or to delete a queue, you must be assigned the role of Queue administrator.
  2. Click Queue Management in the left navigation bar and click + Create New Queue.
  3. On the Create New Queue dialog, in the Name field, enter the name of the queue that you want to create.
    Create New Queue dialog
  4. (Optional) In the Queue Leader field, click the Select Queue Leader link to open a User(s) dialog. Select the user that you want to assign as the queue leader and click OK.
    User(s) dialog
  5. From the Owners drop-down list, assign the team which will be the owners of this queue and click Link Team.
    Create a new queue - Owners drop-down list
    Important: If you do not select any team to be the owner of this queue, then by default the queue is assigned to the team of the user who created the queue.
  6. (Optional) In the Description field, enter the description for the queue.
  7. (Optional) In the Assigned Queue Members section, click the click here to assign Queue Members link or click the Add Queue Member menu, to open a User(s) dialog. Select the user (s) that you want to assign as team members and click OK.
  8. Click Save to create the new queue.
    The new queue appears in the Assigned Action Item pane. You can view the queue details like team members of this queue, the leader of the queue, and the tasks assigned to the queue.
    Newly created queue
  9. To delete a queue, click the Delete Queue icon.
    Note: A queue can be deleted only when there are no tasks assigned to the queue.

Assigning tasks to queues or users

To assign or remove tasks from a queue or to users, you must be assigned the role of Queue administrator or Queue leader. You can assign tasks in bulk, or individually to a queue, or individually to a user. Tasks that are unassigned appear in the Unassigned Action Items pane. Queues and individuals to whom tasks can be assigned are present in the Assigned Action Items pane. To assign tasks to a queue ensure that you select the By Queue option in the Assigned Action Items pane. To assign tasks to an individual ensure that you select the By Individual option in the Assigned Action Items pane.

Once you assign a task to a user, a user gets a notification. The Notification icon is present on the top-right corner in FortiSOAR, and when a user has a notification, the icon blinks with a red light. Click the icon to open the list of your notifications. In the case of tasks, the notifications, appear as Action Items as shown in the following image:

Notifications list

  1. To assign tasks individually to a queue, select the unassigned task from the module, for example, Alerts, and drag and drop that task on the queue to which you want to assign the task.
    Assign tasks individually to a queue
  2. To assign tasks in bulk to a queue, click to select the unassigned tasks from the module, for example, Alerts. You will see the number of items that you have selected appear in the Bulk Assign Bucket dialog. Drag and drop the Bulk Assign Bucket dialog on the queue to which you want to assign the task.
    Assign tasks in bulk to a queue
  3. To assign tasks individually to an individual, click the By Individual link and then select the unassigned task from the module, for example, Alerts, and drag and drop that task on the username to whom you want to assign the task.
    Assign tasks individually to an individual
    Similarily, to assign tasks in bulk to an individual, click the By Individual link and then select the unassigned tasks from the module, for example, Alerts. You will see the number of items that you have selected appear in a dialog. Drag and drop that dialog on the username to whom you want to assign the task.
  4. To reassign tasks, click the Queue Tasks icon to open the list of tasks assigned to that queue. On the task row that you want to reassign, click the User icon. Clicking the User icon opens a Team Member of "Queue Name" dialog. Select the user to whom you want to reassign the task and click OK. In the following image, the task has been reassigned to the CS Admin user.
    Team Member of "Queue Name" dialog
  5. To remove a task from a queue, click the Queue Tasks icon to open the list of tasks assigned to that queue. Click the Click to Remove link on the task row to remove the task from the queue.
    Remove a task from a queue
    You will be presented with a Confirm dialog, asking you to confirm the removal of the task and once you click OK the task is removed from the queue.
  6. To remove a task from the queue of an individual, click the By Individual link, and then click the Tasks icon, which displays the tasks assigned to that individual. Click the Click to Remove link on the task row to remove the task from the queue of an individual.
    Remove a task from the queue of an individual
    You will be presented with a Confirm dialog, asking you to confirm the removal of the task and once you click OK the task is removed from the queue.

Working with queues

A queue member can view, assign, reassign and remove the items only from their own queue.

  1. To view, assign or reassign the tasks assigned to you, click Queue Management in the left navigation bar and then click the By Individual link in the Assigned Action Items pane. Click the Tasks icon that appears in the row with your username to view and perform actions on your tasks.
  2. To assign a task to yourself, click the By Queue link in the Assigned Action Items pane. Click the <Queue Name>, for example Alert Queue, which displays the <Queue Name> dialog. In the Queue Actions Items section, click Unassigned to view the list of unassigned tasks. To assign a single task, click the User icon to open a Team Member of "Queue Name" dialog, select yourself and click OK. You can also click multiple tasks that you want to assign to yourself and click More Options > Assign to me.
    A Queue administrator or Queue leader can click More Options > Bulk Assignment to Queue Member to assign tasks to a team member. Clicking Bulk Assignment to Queue Member opens a Team Member of "Queue Name" dialog. Select the user to whom you want to assign the task and click OK.
    Queue Detail dialog - Assign to me
  3. To reassign your task to another user, on the <Queue Name> dialog, in the Queue Actions Items section, click Assigned to view the list of tasks that are assigned to you. Select the task that you want to reassign and click the User icon to open a Team Member of "Queue Name" dialog, select the user to whom you want to reassign the task and click OK.
    Queue Detail dialog - Assigned Items: Reassign
  4. To unassign a task that you are assigned to from your queue, on the <Queue Name> dialog, in the Queue Actions Items section, click Assigned to view the list of tasks that are assigned to you. Select the task that you want to remove from your queue and click the User icon to open a Team Member of "Queue Name" dialog, select yourself and click OK. This removes the task from your queue and moves that task back to the queue as an unassigned item.

Automating queue assignment

You can add rules to automatically assign unassigned items to specific queues or users for modules that have been configured for queue management.

  1. Click Queue Management in the left navigation bar.
  2. From the Menu option, click the Automate Queue Assignment.
    Automate Queue Assignment option
    This opens the Queue Dashboard Module Configuration dialog with Automate Queue Assignment tab selected. The Automate Queue Assignment tab displays all the modules that have been configured for queue management.
  3. Click the module for which you want to automate queue assignment.
    For example, click Incidents.
    Automate Queue Assignment tab: Incidents module
  4. To add the rules based on which unassigned items will be assigned, click Add Rule for Incidents.
  5. In the Filter Criteria section, click the Add Condition link.
    For example, if you want to assign only critical and open unassigned items automatically, then you can specify the rules as follows:
    Specify a condition by specifying a field, based on the resource you have selected, in our example Incidents.
    For our example, In the Filter Criteria section, click the Add Condition link, and from the Select a field drop-down list select the field on which you want to define the filter, select Severity, next specify an operator from the Operator drop-down list, select Equals, and then select an option from the Select an Option drop-down list, select Critical.
    To add multiple conditions, click the Add Condition link again. If you have multiple conditions, you must define a Logical operator such as and or or from the Select Logical drop-down list. By default, this is set to and.
    For our example, click Add Condition, and then add another condition for Status Equals Open.
    Adding conditions to the rules defined for automating queues
  6. To assign the unassigned items based on the condition you have specified, in the Assign to section, do the following:
    To assign the unassigned items to a queue, in the Assign To section, from the Select Queue drop-down list select the queue. For example, Critical Incidents Queue.
    Automating queues: Assigning unassigned items to a specific queue
    To assign the unassigned items to an individual, in the Assign To section, from the Select individual drop-down list select the individual. For example, S S.
    Automating queues: Assigning unassigned items to a specific user
    You can also specify both the user and the queue. In this case, once you specify a queue, you will see only the users who are the members of that queue. For example, if you have specified the Critical Incidents Queue queue, you can see only those users who are members of this queue. You can assign the tasks of this queue to either S S or New User who are members of that queue.
    Automating queues: Assigning unassigned items to a specific queue and a specific user
  7. Click Save Rule for Incidents.
    Once you save the rule, FortiSOAR adds two Active playbooks based on the rules, one for the Create action and one for the Update action. In our example, this means that the playbooks would automatically run and assign unassigned critical items in two scenarios, once when a critical incident is created, and secondly when the severity of an already created incident is changed to Critical.
    Automating queues: Active Playbooks added
    If you want to extend the functionality or modify the created playbooks, click the New Tab (New Tab icon) icon. This will open the created playbook, and then you can modify the playbook as required.
    Automating queues: Sample Create Playbook
    To delete a rule, click the Delete Rule icon.

Queue Management

Queues provide managers a view that answers questions like, "what are my resources working on currently?", "how many tasks are pending?", and "do any tasks require reallocation?". Queues provide users a view that answers questions like "what is my work?", "how much of my work is pending?", and "what is the priority of my tasks?".

FortiSOAR provides you with the Queue Management feature that provides you with an overview of work (records) that requires to be completed and enables you to assign pending work to users. You can also reassign assignments in case of absence or shift change.

Note

The Alerts, Incidents, and Tasks modules are added as default modules in Queue Management. You do not require to configure these modules for Queue Management.

Queue Management roles

Logical Role Description Minimum permissions required
Queue administrator The queue administrator has the rights to manage queues, including creating and deleting queues, assigning a queue leader and members and assigning tasks.
A queue administrator can also be a queue leader or a queue member.
Create, Read, Update, and Delete permissions on the System Assigned Queues module.
Queue leader A queue lead has similar rights to the queue administrator, except that the lead cannot create or delete queues.
A queue leader can also be a queue member.
Read and Update permissions on the System Assigned Queues module.
Queue member A queue member can view, assign, and remove the items from their queue. Read permissions on the System Assigned Queues module.
Note

To change the configurations or settings of queues, you must be assigned a role that has Create, Read, Update, and Delete (CRUD) permissions on the Application module and at the minimum Read permissions on the System Assigned Queues module.

Prerequisites to configuring queue management

To use queue management, follow the given steps to enable a module for queue management:

Note

The following procedure is an example of how you can enable a module for queue management. This procedure takes the example of the 'Alerts New' module. By default the Alerts, Incidents, and Tasks modules are added as default modules in Queue Management and therefore you do not need to add the System Assigned Queue to any of these modules.

  1. User must be assigned the role that has Create, Read, Update, and Delete (CRUD) permissions on the Application module and at the minimum Read permissions on the System Assigned Queues module.
  2. Click Settings and click Modules in the Application Editor section, to open the Module Editor.
  3. On the Modules page, from the drop-down list, select the module for which you want to enable queue management.
    For example, select Alerts New.
  4. Click the Fields Editor tab and click Add (+).
  5. Add the Properties for the field as follows:
    Field Type: Lookup (One to Many or One to One)
    Related Module: System Assigned Queues
    Field Title: System Assigned Queues
    Note: The Field API Key gets automatically populated as systemAssignedQueue.
    Properties for the System Assigned Queue field Click Save and Publish the module. Once the module has published, you are now ready to start configuring queue management.

Configuring queue management

  1. User must be assigned the role that has Create, Read, Update, and Delete (CRUD) permissions on the Application module and at the minimum Read permissions on the System Assigned Queues module.
  2. Click Queue Management in the left navigation bar.
  3. In the Unassigned Action Items pane, you can view the module (s) that have been enabled for queue management. See the Prerequisites section for information on how to enable a module for queue management. In our example, we can see the Alerts module.
    Note: The Alerts module is added as a default module in Queue Management, which does not require any configuration. The following images and steps are a representation of how you can configure any other module in Queue Management.
  4. To open the Queue Dashboard Module Configuration dialog, click the Settings (Settings icon) icon.
    Unassigned Action Item pane: Filter/Sorting Configuration
  5. On the Unassigned Items tab, click the module from which you want to assign items, for example, click Alerts. This displays the User Assignment Field in "Module Name" drop-down list in which select the field that is used in the module for assigning the record to a user. For example, select Assigned To.
    Note: By default, lookup fields in FortiSOAR display only the first 30 items. If you want to search for more than 30 items, please use the Search text box.
  6. In the Filter Criteria for Unassigned "Module Name" section, add a criterion that filters the User Assignment Field in the module (Alerts in our example) for unassigned records, i.e., set the User Assignment Field in "Module Name" field to (Assigned To" in our example) to null, as shown in the following image:
    Unassigned Item Configuration tab
    Also, in the Card Marker in "Module Name" drop-down list, select the criteria based on which you that you want to display the marker beside the unassigned items. You can choose between Severity, Status, and Type. For example, if you select Severity as the criteria, markers are displayed beside the unassigned alerts, so that users can immediately know the items that they need to prioritize.
    The nested filter component is also added to the Unassigned Items and Assigned Items tabs, allowing you to filter these items. For more information about nested filters, see the Dashboards, Templates, and Widgets chapter.
    Note: You cannot apply filters to encrypted fields.
  7. Click the Assigned Items tab, click the module from which you want to assign items, for example, click Alerts. This displays the Filter Criteria for Queue "Module" section to add a criterion that filters records that specifies the field and state to determine that the task (record) is not completed, and therefore should be added to the queue. For example, for the Alerts module, specify that the Status field of the record is not Closed, as shown in the following image:
    Queue Items Configurations tab
  8. (Optional) In the Default Sort For Queue <Name of the module> section, you can specify the sorting criteria for records in the queue. For example, for the Alerts module, specify that the records should be sorted on Severity in the descending order.
  9. Click Save.

Creating and deleting queues

  1. To create a new queue, or to delete a queue, you must be assigned the role of Queue administrator.
  2. Click Queue Management in the left navigation bar and click + Create New Queue.
  3. On the Create New Queue dialog, in the Name field, enter the name of the queue that you want to create.
    Create New Queue dialog
  4. (Optional) In the Queue Leader field, click the Select Queue Leader link to open a User(s) dialog. Select the user that you want to assign as the queue leader and click OK.
    User(s) dialog
  5. From the Owners drop-down list, assign the team which will be the owners of this queue and click Link Team.
    Create a new queue - Owners drop-down list
    Important: If you do not select any team to be the owner of this queue, then by default the queue is assigned to the team of the user who created the queue.
  6. (Optional) In the Description field, enter the description for the queue.
  7. (Optional) In the Assigned Queue Members section, click the click here to assign Queue Members link or click the Add Queue Member menu, to open a User(s) dialog. Select the user (s) that you want to assign as team members and click OK.
  8. Click Save to create the new queue.
    The new queue appears in the Assigned Action Item pane. You can view the queue details like team members of this queue, the leader of the queue, and the tasks assigned to the queue.
    Newly created queue
  9. To delete a queue, click the Delete Queue icon.
    Note: A queue can be deleted only when there are no tasks assigned to the queue.

Assigning tasks to queues or users

To assign or remove tasks from a queue or to users, you must be assigned the role of Queue administrator or Queue leader. You can assign tasks in bulk, or individually to a queue, or individually to a user. Tasks that are unassigned appear in the Unassigned Action Items pane. Queues and individuals to whom tasks can be assigned are present in the Assigned Action Items pane. To assign tasks to a queue ensure that you select the By Queue option in the Assigned Action Items pane. To assign tasks to an individual ensure that you select the By Individual option in the Assigned Action Items pane.

Once you assign a task to a user, a user gets a notification. The Notification icon is present on the top-right corner in FortiSOAR, and when a user has a notification, the icon blinks with a red light. Click the icon to open the list of your notifications. In the case of tasks, the notifications, appear as Action Items as shown in the following image:

Notifications list

  1. To assign tasks individually to a queue, select the unassigned task from the module, for example, Alerts, and drag and drop that task on the queue to which you want to assign the task.
    Assign tasks individually to a queue
  2. To assign tasks in bulk to a queue, click to select the unassigned tasks from the module, for example, Alerts. You will see the number of items that you have selected appear in the Bulk Assign Bucket dialog. Drag and drop the Bulk Assign Bucket dialog on the queue to which you want to assign the task.
    Assign tasks in bulk to a queue
  3. To assign tasks individually to an individual, click the By Individual link and then select the unassigned task from the module, for example, Alerts, and drag and drop that task on the username to whom you want to assign the task.
    Assign tasks individually to an individual
    Similarily, to assign tasks in bulk to an individual, click the By Individual link and then select the unassigned tasks from the module, for example, Alerts. You will see the number of items that you have selected appear in a dialog. Drag and drop that dialog on the username to whom you want to assign the task.
  4. To reassign tasks, click the Queue Tasks icon to open the list of tasks assigned to that queue. On the task row that you want to reassign, click the User icon. Clicking the User icon opens a Team Member of "Queue Name" dialog. Select the user to whom you want to reassign the task and click OK. In the following image, the task has been reassigned to the CS Admin user.
    Team Member of "Queue Name" dialog
  5. To remove a task from a queue, click the Queue Tasks icon to open the list of tasks assigned to that queue. Click the Click to Remove link on the task row to remove the task from the queue.
    Remove a task from a queue
    You will be presented with a Confirm dialog, asking you to confirm the removal of the task and once you click OK the task is removed from the queue.
  6. To remove a task from the queue of an individual, click the By Individual link, and then click the Tasks icon, which displays the tasks assigned to that individual. Click the Click to Remove link on the task row to remove the task from the queue of an individual.
    Remove a task from the queue of an individual
    You will be presented with a Confirm dialog, asking you to confirm the removal of the task and once you click OK the task is removed from the queue.

Working with queues

A queue member can view, assign, reassign and remove the items only from their own queue.

  1. To view, assign or reassign the tasks assigned to you, click Queue Management in the left navigation bar and then click the By Individual link in the Assigned Action Items pane. Click the Tasks icon that appears in the row with your username to view and perform actions on your tasks.
  2. To assign a task to yourself, click the By Queue link in the Assigned Action Items pane. Click the <Queue Name>, for example Alert Queue, which displays the <Queue Name> dialog. In the Queue Actions Items section, click Unassigned to view the list of unassigned tasks. To assign a single task, click the User icon to open a Team Member of "Queue Name" dialog, select yourself and click OK. You can also click multiple tasks that you want to assign to yourself and click More Options > Assign to me.
    A Queue administrator or Queue leader can click More Options > Bulk Assignment to Queue Member to assign tasks to a team member. Clicking Bulk Assignment to Queue Member opens a Team Member of "Queue Name" dialog. Select the user to whom you want to assign the task and click OK.
    Queue Detail dialog - Assign to me
  3. To reassign your task to another user, on the <Queue Name> dialog, in the Queue Actions Items section, click Assigned to view the list of tasks that are assigned to you. Select the task that you want to reassign and click the User icon to open a Team Member of "Queue Name" dialog, select the user to whom you want to reassign the task and click OK.
    Queue Detail dialog - Assigned Items: Reassign
  4. To unassign a task that you are assigned to from your queue, on the <Queue Name> dialog, in the Queue Actions Items section, click Assigned to view the list of tasks that are assigned to you. Select the task that you want to remove from your queue and click the User icon to open a Team Member of "Queue Name" dialog, select yourself and click OK. This removes the task from your queue and moves that task back to the queue as an unassigned item.

Automating queue assignment

You can add rules to automatically assign unassigned items to specific queues or users for modules that have been configured for queue management.

  1. Click Queue Management in the left navigation bar.
  2. From the Menu option, click the Automate Queue Assignment.
    Automate Queue Assignment option
    This opens the Queue Dashboard Module Configuration dialog with Automate Queue Assignment tab selected. The Automate Queue Assignment tab displays all the modules that have been configured for queue management.
  3. Click the module for which you want to automate queue assignment.
    For example, click Incidents.
    Automate Queue Assignment tab: Incidents module
  4. To add the rules based on which unassigned items will be assigned, click Add Rule for Incidents.
  5. In the Filter Criteria section, click the Add Condition link.
    For example, if you want to assign only critical and open unassigned items automatically, then you can specify the rules as follows:
    Specify a condition by specifying a field, based on the resource you have selected, in our example Incidents.
    For our example, In the Filter Criteria section, click the Add Condition link, and from the Select a field drop-down list select the field on which you want to define the filter, select Severity, next specify an operator from the Operator drop-down list, select Equals, and then select an option from the Select an Option drop-down list, select Critical.
    To add multiple conditions, click the Add Condition link again. If you have multiple conditions, you must define a Logical operator such as and or or from the Select Logical drop-down list. By default, this is set to and.
    For our example, click Add Condition, and then add another condition for Status Equals Open.
    Adding conditions to the rules defined for automating queues
  6. To assign the unassigned items based on the condition you have specified, in the Assign to section, do the following:
    To assign the unassigned items to a queue, in the Assign To section, from the Select Queue drop-down list select the queue. For example, Critical Incidents Queue.
    Automating queues: Assigning unassigned items to a specific queue
    To assign the unassigned items to an individual, in the Assign To section, from the Select individual drop-down list select the individual. For example, S S.
    Automating queues: Assigning unassigned items to a specific user
    You can also specify both the user and the queue. In this case, once you specify a queue, you will see only the users who are the members of that queue. For example, if you have specified the Critical Incidents Queue queue, you can see only those users who are members of this queue. You can assign the tasks of this queue to either S S or New User who are members of that queue.
    Automating queues: Assigning unassigned items to a specific queue and a specific user
  7. Click Save Rule for Incidents.
    Once you save the rule, FortiSOAR adds two Active playbooks based on the rules, one for the Create action and one for the Update action. In our example, this means that the playbooks would automatically run and assign unassigned critical items in two scenarios, once when a critical incident is created, and secondly when the severity of an already created incident is changed to Critical.
    Automating queues: Active Playbooks added
    If you want to extend the functionality or modify the created playbooks, click the New Tab (New Tab icon) icon. This will open the created playbook, and then you can modify the playbook as required.
    Automating queues: Sample Create Playbook
    To delete a rule, click the Delete Rule icon.