Automating SLA in XSOAR with Reminders and Reset on Updates

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Automating SLA in XSOAR with Reminders and Reset on Updates

L0 Member

Hi team!

 

First of all, thank you very much in advance for your help.

 

I want to add an SLA to an incident in XSOAR so that if the SLA is breached, the incident is automatically closed. In theory, this is straightforward to implement by setting a timer, a task with a tag, and an automation to close the incident, as specified in the videos and documentation.

 

However, the situation gets complicated because:

  1. I need to send daily reminders until the incident is closed.
  2. If the incident is updated (e.g., a note is added), the SLA should "reset."

 

With these additional requirements, it seems the functionality of timers/SLA falls a bit short.

A possible workaround would be to develop an automation that performs all the mentioned tasks and runs as a scheduled job, but before resorting to that, I would like to use the SLA field since it seems to be the most optimal solution.

 

What do you think?

Thank you very much and best regards, Fer

1 REPLY 1

L3 Networker

Hi @F.Otero 

You should be able to achieve this by utilizing !ScheduleCommand which is better than timer because if the server restarts, timer is lost while scheduled commands will execute as long as the scheduled time approaches.
What I would do is you would schedule command to closeinvestigation when a specific time (whenever SLA will breach for example), and create a job to send out the reminder by running !ShowScheduledEntries to identify when and what command is scheduled to be executed and use this information to send out the reminder.
As far as I know, to find out when there is an update, this might need to be done via API since I did not find an incident field that gets updated when there is a new comment to the War Room. There is a field called "modified" that you might be able to use depending on what would be considered update.

Once the incident is updated, you can modified the scheduled command of closeinvetigation to different time.

 

Let me know if you have any questions about this.

  • 372 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!