This guide walks through how fraud operators can review and take action on incidents using the Darwinium Incident Manager. It includes annotated screenshots to help you get up and running quickly.
🚀 Getting Started
When you log in to the Incident Manager view, you'll see your Personal Queue on the left. This contains all incidents assigned to you.
Step 1: Take a New Incident
Click the "Take" button at the top of the queue to assign yourself the next available incident.
- Once assigned, the incident will appear in your personal queue (e.g. INC-34).
- The label (e.g. "Blue Queue") indicates the source queue.
🔍 Step 2: Review the Incident
After taking an incident, you’ll be shown a detailed view like this:
Key Sections
- Incident Tabs: Toggle between core, all, or related events.
- Incident Rule Details: Shows the rule and signal that triggered the alert.
- Incident Visualization: Geolocation, timeline chart, and other widgets to help you understand behavior.
- Events Table: Shows detailed event data. Default columns include any attributes used in the detection rule. Columns can be customized using the same controls found in the Investigations or Journey views.
- Right Panel: Shows event metadata when a row is clicked.
💡 Tip: You can pause/resume the timer to track time worked on the case.
🧪 Step 3: Investigate Events
- Select events using the checkboxes in the table.
- Right-click any selected event to take granular actions:
Available Actions:
- Show raw data
- Close with alternative close action (set attributes, labels, or event types)
- Color: Visually tag specific cells or values
- Copy / Export: Useful for external analysis or evidence collection
You can exclude certain events from bulk actions this way.
✅ Step 4: Take Action
Once reviewed, either close or escalate the incident.
Option A: Close the Incident
Click Close Incident and choose an action to apply to all events.
Available close actions are configured by your queue administrator per Configuring Queues
These actions will apply to all events unless excluded manually.
Option B: Re-assign the Incident
Click Re-assign to escalate the incident to another operator or queue. The incident remains open and visible to the receiving team.
🧾 Additional Notes
- Time Tracking: Automatically starts on open. Pausing is optional. Used for SLA and performance reporting.
- Rule Context: The rule that triggered the incident is always visible, including the feature threshold and signal name.
- Event Table Defaults: Columns shown include all attributes referenced in the detection rule condition by default.
- Custom Views: Table layout and widgets can be configured per user and persist across sessions.