topic Re: Check dormant instance in multitenant. in Cortex XSOAR Discussions

Check dormant instance in multitenant.

MKececioglu — Mon, 31 Oct 2022 11:28:33 GMT

Hi,

I need a job or another mechanism to detect if last incident creation time is older than 1 hour or a given time period to detect if there is an incident pull problem in SOAR or a siem centric problem.

Regards.

Re: Check dormant instance in multitenant.

MKececioglu — Tue, 01 Nov 2022 07:09:26 GMT

Ok, i handled it , here is how i did.

Task -1

Task -2

Task -3

For yes condition send mail or create a new incident or whatever you want.

Job

A scheduled jop to trigger every 30M to avoid missing of last time dormant alarm.

Re: Check dormant instance in multitenant.

MKececioglu — Tue, 01 Nov 2022 07:21:21 GMT

@MKececioglu thx !!

Re: Check dormant instance in multitenant.

MKececioglu — Tue, 01 Nov 2022 07:21:36 GMT