Hi Resilient Community!

I have been looking for a way to have Resilient email analysts regarding cases that haven't been updated in x amount of time, that are still currently open. a.k.a Delinquent cases.

I see that Resilient already has a built in field "inc_last_modified_date", however I cannot reference that field within notifications. I reached out to support about this, and they said this is by design. "This is due to the nature of that field (it is a calculated field), and the timing would not work properly with notifications."
I'm just reaching out to see if anyone else had figured out a work around to achieve this functionality?

Thanks!

Kyle.

------------------------------
Kyle Cisco
------------------------------

It is true that it is not possible to use the incident last modified date in a notification or rule condition. However even if that were available in the UI I'm not sure the service has the ability to periodically check the conditions based on rules. 

However a Workflow does have the ability to run timers. You could set up a timer to run on a 15 minute interval for the incident. This would send off a message to a Function with the last modified date. The function could perform the check and then send out an email. 

I'm not certain if there are existing functions on the app exchange that have something similar.

------------------------------
Ben Lurie
------------------------------