11-01-2024 04:41 AM
Is there a way to receive an alert when no incidents are fetched in XSOAR for a certain integration for by example 24 hours. Not related to integration issues but if the integration works but nothing is fetched?
Would be beneficial to know if there is a issue with a log source.
11-12-2024 08:02 AM
Hello,
i suggest doing JOB task. You can use task "GetIncidentsByQuery", set it to "1 day ago", put there your query, for example "sourceInstance: 'my SIEM instance'". Make a condition after it, if the response is defined, send a notification email to you. Set the job to run every 1 hour or so and you are good to go.
Hope this helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
