Check dormant instance in multitenant.

[MKececioglu]

Hi,

I need a job or another mechanism to detect if last incident creation time is older than 1 hour or a given time period to detect if there is an incident pull problem in SOAR or a siem centric problem.

Regards.

[MKececioglu · Accepted solution]

Ok, i handled it , here is how i did.

Task -1

Task -2 

Task -3

For yes condition send mail or create a new incident or whatever you want.

Job

A scheduled jop to trigger every 30M to avoid missing of last time dormant alarm. 

[MKececioglu]

@MKececioglu thx !!

[MKececioglu]

NP