Start with onboarding
Review at the decision
The mentor checks the conclusion before an eligible case closes.
MSSP/MDR · People
Scale your team with junior analysts.
A mentor reviews before the case closes.
Magister connects junior analysts with mentors at the point of closure. When an analyst in an active mentorship proposes closing a case they own or are assigned to, the mentor reviews the conclusion; approval closes the case, while requested changes keep it open for rework.
Active mentorship gates eligible closuresJuniors work real customer casesFeedback on the case they worked
CasebookJuniper
JN-77
J. DahlAssigned analyst
New inbox forwarding ruleCustomer case / Juniper
J. DahlAssigned analystFalse PositiveProposed disposition
For reviewThe analyst proposes a conclusion before the case closes.
Magister
- Analyst
- J. Dahl
- Mentor
A. Rivera- Mentorship
- Active
- Case scope
- Assigned case
- Proposal
- False Positive
The licensed capability and relevant permissions apply.
MagisterJuniper
Review the reasoningA. RiveraAssigned mentor
JN-77Closure proposal from J. Dahl
For reviewJ. DahlA. RiveraAssigned mentorFalse PositiveProposed disposition
The proposal goes to the mentor instead of closing the case.
Casebook
- Case
- JN-77
- Customer
- Juniper
- Analyst
- J. Dahl
- Status
- Still open
Active mentorship and eligible owned or assigned casework define the gate’s scope.
MagisterJuniper
Review the reasoningA. RiveraChecks the proposed dispositionReviewing
ConclusionForwarding rule appears to be expected activity
Supporting workCompare the account activity with linked evidence
A. RiveraChecks the proposed dispositionThe mentor checks the work before deciding on closure.
Casebook
JN-77New inbox forwarding rule
Linked alertCustomer identity activity
Analyst notesReasoning behind the proposed conclusion
Illustrative case evidence. The mentor can ask for further work.
MagisterJuniper
Close or improve
ApprovalMentor accepts the conclusion
Case closesJN-77Reviewed closure proposal
One possible outcome: the mentor approves and the case closes.
Close or improve
Request changesMentor asks for further work
Stays openFeedbackCheck the account activity before concluding
Alternative outcome: the analyst reworks the conclusion while the case remains open.
Magister requires the relevant licensed capability and permissions. The gate applies to active mentorships and eligible owned or assigned cases.
J. Dahl proposes a conclusion on an assigned Juniper case while an active mentorship applies.
The proposed closure goes to A. Rivera for review instead of closing the case.
The mentor examines the conclusion and supporting work, then gives feedback.
These are alternative outcomes: approval closes the case; requesting changes keeps it open for rework.
Illustrative customer workflow
01 - What it does
Coach before the case closes.
A customer case is a concrete place to review an analyst’s judgment. Magister puts the mentor’s decision before an eligible closure, with a path back to investigation when the work needs improvement.
Keep review in the case workflow.
An active mentorship connects the junior analyst with a mentor. When the analyst proposes closing an eligible case they own or are assigned to, the proposal goes for review instead of closing the case. The mentor checks the reasoning and gives feedback. Approval closes the case; a request for changes keeps it open, so the analyst can address the conclusion before the work is finished. The feedback gives the analyst a concrete next step on that customer’s case.
Juniors work real customer cases, and the customer still gets a reviewed closure.
Juniper: J. DahlExample
- Mentor
- A. Rivera
- Mentorship
- Active
- Case scope
- Owned or assigned
- Decision point
- Closure proposal
Illustrative setup and values, not customer results.
A path back to the work
Requested changes keep the case open for the analyst to improve.
02 - How it works in the product
Propose, review, close or improve.
The closure decision gives mentor and analyst a shared piece of work to examine. Apply the licensed capability and active mentorship, then use the review outcome to decide whether the case can close.
- 01Casebook
Investigate an eligible case owned by or assigned to the junior analyst.
- 02Magister
Send the proposed disposition to the mentor while the mentorship is active.
- 03Magister
Have the mentor review the reasoning and give feedback.
- 04Casebook
Close on approval, or keep the case open for rework when changes are requested.
Magister routes eligible junior closure requests to a mentor; license, permissions and active mentorship apply.
03 - How it connects
Keep quality beside the investigation.
Casebook holds the evidence and conclusion that the mentor reviews. Magister adds the eligible closure gate, while the provider’s operations lead can make that review part of the team’s governance practice.
Works with
In the editions
The PortalOutside the defaults
Discuss a license covering AI and provider operations.
Autonomous SOCIncluded
The AI capability belongs to this tier.
SecOps PlatformIncluded
Includes the Autonomous SOC capabilities.
04 - What it means for your service
Grow the team without lowering the bar.
A provider can give junior analysts customer casework while retaining a mentor decision on eligible closure proposals. Feedback returns to the work that prompted it, giving the analyst something concrete to improve.
Mentoring on real work
Review the conclusion of the customer case the analyst handled.
A defined closure gate
Approval closes an eligible case; requested changes leave it open.
A reviewed conclusion
The mentor can examine the reasoning before the case is finished.
Start with one customer
- 01Check eligibility
Confirm the licensed capability, permissions and active mentorship.
- 02Choose an assigned case
Have the analyst work a case within the gate’s scope.
- 03Review the conclusion
Have the mentor approve closure or request specific improvements.
Questions about Magister.
1Does a mentor have to approve every case?
The gate applies to an analyst in an active mentorship proposing closure of an eligible case they own or are assigned to. Magister requires the relevant licensed capability and permissions. Approval closes that case; a request for changes keeps it open for rework.
2Is Magister in The Portal’s defaults?
No. Magister belongs to the Autonomous SOC tier and is included in SecOps Platform. It is outside The Portal’s default module set. Confirm enabled capabilities and permissions for the provider workflow you intend to run.
Have any other questions? Talk to our team
Review the conclusion.
Improve the next decision.
Walk through eligible case closure and mentor review with the Imperum team.