Start with onboarding
A basis for urgency
The weighted score keeps available risk evidence behind the recommendation.
MSSP/MDR · People
Give each case a reasoned priority.
Find an owner with context.
Virtus Case Prioritizer combines available evidence into a risk score and priority recommendation. Virtus Case Router ranks analysts using case context, skills and assignment history, with workload and availability in view; choose the routing mode per customer, starting from Off.
Weighted evidence behind prioritySkills and workload inform rankingRouting defaults to Off
CasebookNorthstar
Virtus Case Prioritizer
72/100
HighIllustrative score
Synthetic signal scores with default base weights. Optional signals and narrative are excluded from this example.
- Case
- NS-104
- Title
- Privileged account activity
- Scoring
- New cases by default
Weighted evidence
Alert severityEvidence from linked alerts
Affected entitiesRisk from the case’s entities
Alert velocityObserved activity around the case
Business contextCustomer context behind the work
CasebookNorthstar
Virtus Case RouterNorthstar
OffRecommendAuto
- Case
- NS-104
- Assignment
- A person applies
Router requires its module entitlement.
CasebookJuniper
Virtus Case RouterJuniper
OffRecommendAuto
- Recommendations
- Off
- Automatic assignment
- Off
Routing defaults to Off for each customer.
CasebookNorthstar
Assign Case
A. RiveraIdentity skills / available capacityRecommended
M. KayaDeclared skills / current workload
J. DahlDeclared profile / assignment history
A. RiveraIdentity skills / available capacityM. KayaDeclared skills / current workloadJ. DahlDeclared profile / assignment historyDeterministic ranking before a trained model is available. Analyst profiles are required.
NS-104
- Priority
- High, illustrative
- Title
- Privileged account activity
- Routing mode
- Recommend
- Owner
- Awaiting a person’s choice
- Availability
- Checked for assignment
Workload and availability matter alongside declared skills and observed outcomes.
CasebookNorthstar
NS-104
- Priority
- High, illustrative
- Routing mode
- Recommend
- Owner
- A. Rivera
- Phase
- Investigation
Recommend mode leaves the assignment decision to a person.
TimelineA. RiveraNew case owner
Assignment confirmedA person applied the recommendation
A. RiveraNew case ownerPrivileged account activityCustomer investigation context retained
Response targetFollows applicable priority and phase
Router requires its module entitlement. Routing defaults to Off; Recommend leaves assignment to a person.
The illustrative risk score combines synthetic signals. Automated priority changes respect a severity floor and need evidence.
Northstar uses Recommend; Juniper remains Off. A customer’s mode determines whether assignment is suggested or attempted automatically.
The case context, analyst profiles and workload inform the shortlist. Deterministic ranking applies before a trained model is available.
A person confirms A. Rivera in Recommend mode. The case keeps the ownership decision with its investigation context.
Illustrative customer workflow
01 - What it does
Separate urgency from ownership.
Deciding what needs attention and deciding who can handle it are different tasks. Prioritizer explains the case’s risk, while Router gives your lead an analyst shortlist grounded in skills and workload.
Keep the evidence behind the choice.
The risk score combines available case signals, including severity, affected entities and business context. Automatic scoring for new cases is enabled by default, but the automated path respects a severity floor and does not change priority without evidence. Router ranks analysts against that case. In Recommend mode, your lead reviews the reasons and applies the assignment.
Explain both why a case needs attention and why an analyst is proposed to own it.
Northstar: NS-104Example
- Priority
- High, illustrative
- Evidence
- Severity and business context
- Routing mode
- Recommend
- Owner
- A. Rivera
Illustrative setup and values, not customer results.
A basis for ownership
Skills, assignment outcomes and capacity inform the ranked analysts.
02 - How it works in the product
Score the case. Review its match.
Fill in analyst profiles before asking Router for recommendations. Choose the customer’s routing behavior separately from model training, then inspect the recommendation and confirm who takes the work.
- 01Casebook
Review the new case and its evidence-based priority recommendation.
- 02Case Router
Choose Off, Recommend or Auto for the customer; the default is Off.
- 03Assign Case
In Recommend mode, review the ranked analysts and reasons before confirming ownership.
- 04Casebook
Continue the investigation with the chosen owner and applicable priority and phase targets.
Router requires its module entitlement. Auto attempts to assign an eligible, available analyst; failed assignments and unavailable candidates leave work for the team.
03 - How it connects
Carry priority into the service workflow.
The priority helps determine the applicable response target, and the owner continues the investigation in Casebook. The Portal includes Prioritizer and Router by default for providers keeping their existing security stack.
Works with
In the editions
The PortalDefault module
Case Prioritizer and Case Router are defaults.
Autonomous SOCIncluded
Router requires its module entitlement.
SecOps PlatformIncluded
Includes the Autonomous SOC capabilities.
04 - What it means for your service
Put senior time on the cases that need it.
The priority shows which case needs attention, and the shortlist shows who can take it. Each customer gets the routing behavior it agreed to: Off, Recommend or Auto.
Less assignment guesswork
Declared skills and observed work inform the analyst shortlist.
A deliberate operating mode
Training a ranking model does not enable automatic assignment.
Customer-specific routing
Choose Recommend for a customer that needs a person to confirm ownership.
Start with one customer
- 01Complete analyst profiles
Record the skills and experience the ranker needs.
- 02Start in Recommend
Review the shortlist with the customer’s routing behavior in mind.
- 03Check the handoff
Confirm the case owner and applicable response target.
Questions about Case Prioritizer and Case Router.
1Are priority and assignment automatic?
Automatic scoring for new cases is enabled by default. The automated priority path respects a severity floor and will not change priority without evidence. Routing is separate and defaults to Off. Recommend needs a person to apply the assignment; Automatic attempts eligible new cases subject to availability and routing constraints.
2Can each customer have a different routing mode?
Yes. Set Off, Recommend or Auto per customer. Off provides no recommendations or automatic assignment. Router requires its module entitlement, and analyst profiles are needed for recommendations. Training a model does not turn on automatic assignment.
Have any other questions? Talk to our team
Put evidence behind the priority.
Put context behind the owner.
Review a customer case and your analyst routing controls with the Imperum team.