Automating SLA in XSOAR with Reminders and Reset on Updates

[F.Otero]

Hi team!

First of all, thank you very much in advance for your help.

I want to add an SLA to an incident in XSOAR so that if the SLA is breached, the incident is automatically closed. In theory, this is straightforward to implement by setting a timer, a task with a tag, and an automation to close the incident, as specified in the videos and documentation.

However, the situation gets complicated because:

1. I need to send daily reminders until the incident is closed.
2. If the incident is updated (e.g., a note is added), the SLA should "reset."

With these additional requirements, it seems the functionality of timers/SLA falls a bit short.

A possible workaround would be to develop an automation that performs all the mentioned tasks and runs as a scheduled job, but before resorting to that, I would like to use the SLA field since it seems to be the most optimal solution.

What do you think?

Thank you very much and best regards, Fer

[ysato]

Hi @F.Otero 

You should be able to achieve this by utilizing !ScheduleCommand which is better than timer because if the server restarts, timer is lost while scheduled commands will execute as long as the scheduled time approaches.
What I would do is you would schedule command to closeinvestigation when a specific time (whenever SLA will breach for example), and create a job to send out the reminder by running !ShowScheduledEntries to identify when and what command is scheduled to be executed and use this information to send out the reminder.
As far as I know, to find out when there is an update, this might need to be done via API since I did not find an incident field that gets updated when there is a new comment to the War Room. There is a field called "modified" that you might be able to use depending on what would be considered update.

Once the incident is updated, you can modified the scheduled command of closeinvetigation to different time.

Let me know if you have any questions about this.