Apply and save filters

Filters let you narrow your case search in the queue to precisely target the cases you want to analyze.

You can add each filter using either an AND or OR condition.
Each filter can also include an IS or IS_NOT condition.

The following filters are available:

• Time Frame
• Alert names
• Analysts
• Environments
• Priorities
• Products
• Stages
• Tags
• Playbook Status

Add a filter

Define custom filters to personalize your case queue view.

To add a new filter, follow these steps:

1. Click Cases Filter.
2. In the Case Queue Filter dialog, fill in the required fields. For example, to display high-priority cases that are not in the Investigation stage from the past 24 hours:
   • Set the Time Frame to Last 24 hours.
   • Set the first criteria to Priorities IS High.
   • Set the second criteria to Stages IS_NOT Investigation.
3. Optional: To save the filter for future use, click Save Filter and give it a name. The filter is saved under keyboard_arrow_down Saved Filters in the Case queue header for future use.
4. Click Apply.

Share case queue filters

You can share your case queue filters with other individual users, specific SOC roles (like Tier 1 analysts), or all users.

Filters shared with you or by you display a Shared icon next to their name.

The ability to share filters is based on permissions. To share a filter, your permission group must have the Allow sharing case queue filters permission enabled. This permission is enabled by default for the Admin permission group. For more information about enabling permissions, see Edit a Permission Group.

To share your case queue filters, follow these steps:

1. Add a new filter by following the steps in the Add a filter section.
2. After entering the required information, click Save Filter.
3. In the Save filter dialog, enter a name for the filter and then choose one of the three sharing options:
   • Private (only me): This is the default setting. The filter remains private and visible only to you.
   • Public (all users): The filter becomes visible to all users who have access to cases.
   • Specify users & roles: Select this option to search for and add specific users or predefined SOC roles.
4. Click Save.

Manage your saved filters

You can manage filters you create. This includes the ability to edit their criteria, update share settings, or delete them from the list.

Any changes to a shared filter are applied to all users you've shared the filter with.

To edit a filter you created, follow these steps:

1. In the case queue header, click keyboard_arrow_down Saved Filters.
2. Hold your pointer over the filter you want to manage and click edit .
3. If the filter is shared, a confirmation dialog appears. Click Yes to continue to the Edit filter dialog.
4. Modify the filter criteria or change its sharing configuration.
5. Click Save.

To temporarily modify a shared filter, follow these steps:

1. In the case queue header, click keyboard_arrow_down Saved Filters.
2. Click the shared filter you want to modify.
3. In the case queue header, click Cases Filter to modify the criteria as needed.

Delete a filter

You can delete any filter you created. If the filter is shared, it will no longer be available to the users it was shared with.

To remove a filter, follow these steps:

1. Hold your pointer over the filter you want to delete and select delete .
2. In the confirmation dialog, click Yes to delete the filter.