21. Review queue

The review queue is the shared work list. Every module that finds something a person must look at puts an item here: failed compliance controls, drift, FIM changes, DLP incidents, detection alerts, forensic findings, hardening failures, firewall findings, AD findings, honeypot trips, playbook steps, deployment problems and more. One place to assign, work and close them.

Path: Review queue. Permissions:

Four-eyes: no for every action in this chapter. Each change is written to the item's activity timeline and to the audit trail.

21.1 What you see#

• Tiles: Open items, Critical, High, Assigned to me, Unresolved, Closed.
• Module chips: one per module that has items. Click a chip to show only that module; Clear filter x removes it.
• Filters: Search items..., All statuses, All severities, All priorities (P0 to P4). Clear all x resets every filter.
• Board: four lanes.

Each card shows the priority, the title, the module, the assignee and the due time. OVERDUE in red means the item passed its due time and is still open; "Nh left" is the time remaining.

A link from another page (for example View in review queue on the Hardening page) opens the queue already filtered to that source. The filter line Filtered to source or Filtered by source type says so; Clear filters x removes it.

21.2 Procedure: work an item#

1. Click a card. The item drawer opens.
2. Read Description, Recommended action, Related context (Module, Source type, Source ID, Control, Framework, Agent ID, Investigation ID, Policy ID, Assigned to, Due) and Signal metadata. Context links take you to the source, for example Deploy an agent to this host or Open the credential.
3. Under Actions choose one of: Change status, Assign, Comment, Resolve, Accept risk, Suppress.
4. Fill the small form that opens and confirm. Cancel closes it without change.
5. Read the Activity timeline at the bottom: your change is the newest entry.

The actions#

Procedure: isolate a host from a tamper or silence item#

An item that says an agent was tampered with, or went silent, offers Isolate this host in its drawer to users with Execute containment.

Permission: Execute containment. Four-eyes: yes ("Run a containment action"). Risk: isolation cuts all of the host's traffic except to Lawliet (see 36.2). Rollback: Undo (release isolation) in Defense > Dispatched actions (36.4).

1. Open the item and read why the host is suspect.
2. Press Isolate this host.
3. "Sent for approval. Once someone else signs it, run it from Approvals." Have it approved, then execute it from Approvals > My requests > Execute now. (On one signature it says "Isolation started.")
4. Follow the action in Defense > Dispatched actions.

Review items are never deleted. Close them with Resolve, Accept risk or Suppress.

Moving items on the board#

1. Drag a card to another lane.
2. What you see:
   • To Open, In progress or Remediation: the item takes that lane's main status (open, investigating, remediation required).
   • To Closed: nothing is changed by the drop. The drawer opens instead, because closing needs a choice (resolve, accept risk or suppress) and, for two of them, a justification.

21.3 Good practice#

• Do not close an item with Resolve until the cause is fixed and, where it applies, a re-scan or re-verify confirms it.
• Use Accept risk for a real problem you have decided to live with, and say who decided and until when. Use Suppress for noise. Both are recorded with your name.
• Review items are included in evidence bundles exported by date range or by investigation (chapter 27).

21.4 If it fails#