topic Re: Able to get time when a user opens an XSOAR incident for the first time? in Cortex XSOAR Discussions

Able to get time when a user opens an XSOAR incident for the first time?

weijielim — Tue, 11 Jul 2023 06:07:30 GMT

Hi, I would like to get this context key/value as I need it to track SLAs. Is there a way to do so, rather than manually configuring a button in my playbook workflow to call the `!GetTime` script? Thank you.

Re: Able to get time when a user opens an XSOAR incident for the first time?

akoppad — Tue, 11 Jul 2023 13:28:19 GMT

Hi Weijielim,

You can use the general purpose dynamic section and have this on the layout that opens up first when the incident is opened. In this general purpose dynamic section you can have an automation that will then get triggered and check the time for you and set it either in the context data for you or print in the war room. This way you can track when the incident was opened for the first time. Keep in mind you will have to check if the incident has an owner or a participant added. If yes then the incident was already opened before and you don't have to take any action.

Re: Able to get time when a user opens an XSOAR incident for the first time?

gyldz — Tue, 11 Jul 2023 13:36:30 GMT

Hi @weijielim ,

Unfortunately, you cannot set any context only when the user clicks the incident. You can run a field trigger script to set the context of the current time and user information but you need to make the user change that field. I think it is almost the same effort with !GetTime script.

This information is available under access_logs, if it is useful.

cat /var/log/demisto/access_log | grep "GET /incident/load/"