topic Search in XSOAR for Timers (active incidents) in Cortex XSOAR Discussions

Search in XSOAR for Timers (active incidents)

lslschr1 — Sat, 19 Feb 2022 11:42:48 GMT

Hi all
I would like to search in for running timers that exceed a certain time. I tried it but it didn't worked out.
It should work like this that I can search for an timer (in this case detectionsla the total duration) and afterwards it should show all INC that are still running (active) where the decetion sla is over 16 hours

While running the above described search I don't get any result. But there are running Incidents that are over these 16 hours.

If anyone can help I would really appreciate it.
Thank you

Re: Search in XSOAR for Timers (active incidents)

gfilippov — Sat, 19 Feb 2022 20:11:32 GMT

Hi,
When querying incidents by the total duration of the timer you should use a number of the total seconds, in this case 57,600 seconds,
"ago" would make sense for for a field that holds a specific date, like incidents creation date, but a duration cannot be X time ago.
You can try searching by the timer's dueDate field,
more for example please review:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/work-with-slas/search-incidents-using-sla-and-timer-fields

thanks.