Able to get time when a user opens an XSOAR incident for the first time?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Able to get time when a user opens an XSOAR incident for the first time?

L1 Bithead

Hi, I would like to get this context key/value as I need it to track SLAs. Is there a way to do so, rather than manually configuring a button in my playbook workflow to call the `!GetTime` script? Thank you.

2 REPLIES 2

L1 Bithead

Hi Weijielim,

You can use the general purpose dynamic section and have this on the layout that opens up first when the incident is opened. In this general purpose dynamic section you can have an automation that will then get triggered and check the time for you and set it either in the context data for you or print in the war room. This way you can track when the incident was opened for the first time. Keep in mind you will have to check if the incident has an owner or a participant added. If yes then the incident was already opened before and you don't have to take any action.

L4 Transporter

Hi @weijielim ,

 

Unfortunately, you cannot set any context only when the user clicks the incident. You can run a field trigger script to set the context of the current time and user information but you need to make the user change that field. I think it is almost the same effort with !GetTime script.

This information is available under access_logs, if it is useful.

cat /var/log/demisto/access_log | grep "GET /incident/load/"



  • 1113 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!