Analyst Assignment & Queues

Assign threats to analysts for triage — admins assign to anyone, analysts claim their own — and each analyst filters to an "assigned to me" queue. Every assignment is captured in the audit trail (who assigned what to whom, and when), so ownership is both operational and provable.

Assigning and filtering

Select a threat to open its detail, then use the assignment control: an admin can assign to any user or claim it; an analyst can claim it for themselves. Tick Assigned to me to work only your own queue, and (admins) use the Assigned to dropdown to filter by owner or find unassigned threats. Assign-to-me is also offered as a one-click prompt when you move a single unassigned threat to Investigating.

The Threats toolbar filters by status, severity, type, and a time window (last 24h, 48h, week, month, 2 months, or older — handy for clearing an older backlog). Status and severity filter across the whole table (backed by an index, so filtering is a direct lookup, not a table scan), and Load more pages through results. An explicit Select all | none control (with a tri-state checkbox) operates on the threats matching the current filters, so filtering by type and selecting them all for a bulk action is one click.

Bulk actions

Select any set of threats and assign them all to a user (admins) or claim them for yourself (analysts) in one action, with an Unassign option too. Before reassigning threats that already have an owner, you are told how many will change hands. Bulk status changes and bulk assign/unassign show a persistent in-progress indicator and disable the controls for the duration, so a large action looks like it is working and cannot be fired twice by accident. Each assignment is recorded individually in the audit trail. Analysts can only assign or unassign their own; viewers cannot assign.

Who appears in the assignee picker

The admin assign box suggests admins and analysts who have signed in at least once. Because the editor runs in an isolated VPC and cannot query Cognito directly, each sign-in leaves a small breadcrumb in the config bucket (users/), and the picker lists those — so it works in any region with no extra setup. A user you just created (or one whose role changed) appears after their next login. The box also accepts free text, so you can always type a user's full email address and click Assign even if they are not yet listed. Viewers are never shown as assignees.