Who Me Too'd this topic

Hi team!

First of all, thank you very much in advance for your help.

I want to add an SLA to an incident in XSOAR so that if the SLA is breached, the incident is automatically closed. In theory, this is straightforward to implement by setting a timer, a task with a tag, and an automation to close the incident, as specified in the videos and documentation.

However, the situation gets complicated because:

1. I need to send daily reminders until the incident is closed.
2. If the incident is updated (e.g., a note is added), the SLA should "reset."

With these additional requirements, it seems the functionality of timers/SLA falls a bit short.

A possible workaround would be to develop an automation that performs all the mentioned tasks and runs as a scheduled job, but before resorting to that, I would like to use the SLA field since it seems to be the most optimal solution.

What do you think?

Thank you very much and best regards, Fer