@Sajin MB Awesome! Just to confirm, are your running resilient-circuits somewhere so you can install functions that are available from our app exchange (https://exchange.xforce.ibmcloud.com/hub/Resilient)?
I'm working with another customer you developed a sleeper function that allows for more granular timers in workflows. (See attached screenshot)
This would be a more real time solution as opposed to relying on a cronjob and querying. You could set up the rule to trigger:
Object Type: Incident
Conditions:
Incident created and Status is equal to "New"
Activities:
Run "Ten Minute Alert Workflow"
I would also recommend potentially leveraging our Microsoft Exchange Functions (https://exchange.xforce.ibmcloud.com/hub/extension/26b8726f3320b1de10ad2c252930b0df).
With this setup, you you could send an email directly from inside the workflow without having to rely on the Resilient Notifications feature.
You may also find some other uses for these functions moving forward!
------------------------------
Andrew Wadsworth
------------------------------
Original Message:
Sent: 02-27-2019 11:12 AM
From: Sajin MB
Subject: Email notification for the Incident nearing SLO breach
Hi
Yes we have action module and we have some integrations running like we can serach from resiliient to splunk, we have integrated carbon black with resilient etc.. I just need to get an idea how and where we need to configure this script to check all open incidents.
Regards,
Sajin MB
------------------------------
Sajin MB
Original Message:
Sent: 02-27-2019 09:40 AM
From: Andrew Wadsworth
Subject: Email notification for the Incident nearing SLO breach
@Can Topay I think this should work as well.
Quick question to @Sajin MB, are you currently licensed to use Resilient's Action Module? There may me alternitve solutions with added benefits if you are.
If you do have the action module, do you have any integrations running?
------------------------------
Andrew Wadsworth
Original Message:
Sent: 02-27-2019 03:46 AM
From: Can Topay
Subject: Email notification for the Incident nearing SLO breach
Just an idea;
1 - Create a field and add value for "In Triage" - "New" . (in minutes as script documentation)
2 - Put a cronjob and python script on action processor or resilient srv itself for every min or two depending on your need. Just query for only open incidents for your alert mins value and if passed that limit update a separate boolean field as "True/false".
3 - Put a system notification or rule to send an email in time of update on this boolean field.(put a validation condition to initiate this rule/notification to start only if this field is empty beforehand.)
this should work I think.
------------------------------
Can Topay
Original Message:
Sent: 02-19-2019 02:09 AM
From: Sajin MB
Subject: Email notification for the Incident nearing SLO breach
This is the requirement. Please let me know any feasible solution that we can try it out.
When the Incident is generated in Resilient , incident status will be "New" . Analyst will change the status to "In Triage".
Time difference between status "New" and "In Triage" is calculated as TTA(Time to Triage).
We need to send email notification to operation lead in case if analyst delayed to change the status to "In Triage" (Notification for SLA nearing breach).
I have tried with in production script ,but it will not execute continuously. Please Help.
------------------------------
Sajin MB
------------------------------