---
title: "Case queue · Ataris"
description: "Detections are grouped into cases, ranked, and linked to signup and billing data. The queue is report-only: a person decides, and acts from your own admin tools. Cases also reach you through an API and webhooks."
canonical: "https://ataris.dev/product/case-queue"
last-updated: 2026-11-02
---
# Cases a person can decide on. No surprise bans.

Detections are grouped into cases, ranked, and linked to signup and billing data. The queue is report-only: a person decides, and acts from your own admin tools. Cases also reach you through an API and webhooks.

## Built to avoid the false ban.

Auto-ban scripts ban real customers and sometimes take production down with them. Ataris never acts on its own. It gives a reviewer the evidence and gets out of the way.

### 1. Group: One case per account.

Detections from the same account roll into one case, so a reviewer sees mining, scanning, and the signup together.

Example (CASE #0417): detections = mining, scanning; VMs = vm-3f1c; account = free tier · day 1.

### 2. Rank: Worst first.

Cases are ranked, so the queue starts with the account doing the most damage.

Example (queue): #1 = escape tripwire · vm-41aa; #2 = mining + scan · vm-3f1c; #3 = spam burst · vm-77b0.

### 3. Decide: A person decides.

The case shows runtime evidence next to the account's signup and billing data. The reviewer acts from your admin tools. Ataris records nothing as done until they do.

Example (CASE #0417 · decision): automatic action = none; evidence = host, memory, account; next step = reviewer.

## In, through, and out of the queue.

The queue sits between detection and your existing abuse tooling.

- **In.** What a case is built from. host detections, memory snapshots, signup data, billing data.
- **The case.** What a reviewer sees. timeline, evidence chain, account context, rank.
- **Out.** Where it goes. queue UI, API, webhooks, your admin tools.

## Related

- [Guest memory inspection](https://ataris.dev/product/memory-inspection.md): Processes and binaries from a flagged VM
- [Free-tier abuse](https://ataris.dev/use-cases/free-tier-abuse.md): Farmed credits and repeat signups
- [Abuse detection](https://ataris.dev/product/abuse-detection.md): Mining, scanning, spam, farmed free tiers

## Fewer false bans, starting this week.

Book a demo and we'll walk through a case from detection to decision.

[Book a demo](https://ataris.dev/contact)