Incident Management Quickstart
Creating an Incident Management Team
Set up your first team and assign admin or analyst roles.
- Creating and Configuring Queues - Define logical rules for grouping incidents and managing workflows.
- Working an Incident - Review, label, and resolve incidents assigned to you.
- Managing Team Access and Roles - Control who can configure vs. who can work incidents.
- Configuring Incidents with YAML - Use version-controlled YAML files to manage your incident management setup.
- Triggering Incidents - How to trigger incidents from rules and define grouping conditions
Incident Management Overview
Incident management is a structured way to track, review, and resolve risky or suspicious activity—whether it’s a potential account takeover, scam, or false positive. For fraud analysts and investigators, it provides a centralized workflow to assess threats efficiently, assign outcomes, and take appropriate action.
Why Use Incident Management?
A single risky signal isn't usually enough. You need a way to group related activity, assign it to the right person, and ensure consistent handling across teams. Incident management brings structure to that process by:
- Organizing events into manageable queues
- Enabling case assignment, reassignment, and escalation
- Supporting outcome labeling for analysis and feedback loops
- Helping teams prioritize what matters, while keeping audit trails and team accountability
Darwinium Incident Management
Darwinium provides a native incident management system built directly into the platform, giving teams end-to-end control without needing an external case tool. It can also complement your existing workflows, acting as a triage or investigation layer.
Key features
1. Team-Based Workflows: Define incident management teams with role-based access. Admins manage queues and settings; analysts work incidents assigned to them.
2. Queue Configuration: Create custom queues to group incidents by type, severity, or business logic. Expiry rules can be applied to manage backlog automatically.
3. Automatic Assignment: Incidents are triggered based on configured conditions and routed to the right queue and team without manual intervention.
4. Outcome Labeling: Apply labels to key identifiers (e.g. journey ID, device ID, account) to track outcomes such as scam, mule, or false positive—helping reinforce models and reduce repeat reviews.
5. Collaborative Case Handling: Work incidents in real time, reassign them to other team members, and use audit trails to stay aligned.
6. YAML-Based Configurations: Define your queues, labels, and routing logic via YAML files—supporting version control and fast configuration updates across environments.
✅ Incident management is available within the Portal by default, without additional setup or module. Just create your first team and queue to begin managing incidents.