SLA changes that are made by field change scripts are getting reverted

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

SLA changes that are made by field change scripts are getting reverted

L2 Linker

Hi, I have a a field trigger script assigned to a status field. When it changes, the script stops an SLA and starts another and these are Time To Assignment and Response SLA respectively. I have one tenant that refuses to keep the changes meaning that it sets the SLAs and then within a second all is reverted. I can clearly see it on the incident page that Response

SLA changes for less then second and goes back to its previous state like it wasn't run in the first place.

 

 

When the script is run manually from CLI, everything is fine.

 

This is how I am setting the SLAs

```

demisto.executeCommand("stopTimer", {"timerField": "timetoassignment"})
demisto.executeCommand('startTimer', {'timerField':'responsesla'})

```

 

I am not sure if it helps but this tenant is created after the server is upgraded from 6.2.0 to 6.6.0

 

first statefirst stateResponse SLA is running for a secondsResponse SLA is running for a secondschanges are revertedchanges are reverted

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

Hi @EnesOzdemir, I was able to locate the ticket and I think I understand the issue better now.

 

Yes, this is limitation of the platform. To prevent a know issue with DB version synchronisation since 2 different versions of the incident are sent to DB at the same time. The limitation was document here - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/incidents/incident-mana....

 

You will need to de-select the "Run triggered script after incident is modified" option.

View solution in original post

7 REPLIES 7

L4 Transporter

Hi @EnesOzdemir, Can you see the same results in the warroom? Meaning for each screenshot above there should be corresponding "Incident info and changes" entries.

 

I've not seen this behaviour before. It might be that another fieldTrigger script is running. You can check by enabling debug logs. If you still cannot find the root cause, I would suggest raising a support request since this might require investigation of the logs. Could you also confirm that the script in ending as a success? Failed fieldTrigger scripts prevent field changes. 

L2 Linker

Hi, thank you for helping me. yes  I can see the results in the warroom. I believe the script isn't failing because I don't see any errors. The support told me that this issue is related to product implementation so they sent me here.

 

 

EnesOzdemir_0-1653286519023.png

 

 

L2 Linker

I think I found the root cause of the problem. It's related to this part of the field. When I uncheck this all the SLAs are working properly.

EnesOzdemir_0-1653300400132.png

 

I had no problem with this feature on version 6.2.  As I have said before I am running only the following commands to make sure it isn't my script that's causing the problem.

```

demisto.executeCommand("stopTimer", {"timerField": "timetoassignment"})
demisto.executeCommand('startTimer', {'timerField':'responsesla'})

```

 

L4 Transporter

Hi @EnesOzdemir, I was able to locate the ticket and I think I understand the issue better now.

 

Yes, this is limitation of the platform. To prevent a know issue with DB version synchronisation since 2 different versions of the incident are sent to DB at the same time. The limitation was document here - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/incidents/incident-mana....

 

You will need to de-select the "Run triggered script after incident is modified" option.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!