QRadar: Reasons for transferring a case

Answer

Your case can be transferred for many reasons. Below are the most common examples when this occurs:

• When a case comes in outside of local business hours, another team outside of your region might do some work on the case. When their shift is over, the case is transferred to the region, where the ICN is registered.
• When you need to work with a team outside of local business hours (based on your ICN location), request to have a certain team own the case to accommodate your hours needing assistance. For example, your company is based out of the AP region (where the ICN is registered). However, a member of your team is located in the US where they need to work during US business hours. Be sure to note this when you open the case to ensure it does not get transferred back to the AP team.
• A severity 1 system-down issue where the engineer's shift is over and you need to continue working. This scenario calls for a warm-transfer. A warm-transfer includes the original engineer that was working the case to remain on the WebEx or phone call until another engineer is available to take over the case. They will bring the next engineer up-to-speed on the issue so the troubleshooting process is seamless.
• When support determines that a team outside of L2 support needs to assist. Some examples of this include licensing issues, hardware warranty services, and specific issues with QRadar on Cloud where the DevOps team is needed.
• Other times at manager discretion. Reasons for this can include engineer being sick, having vacation, distribute engineer case workload to other team members, or engaging more technical resources.

Again, this is not a comprehensive list of scenarios for transferring a case, but these are the most commonly seen.