Hi Shane, 

 I've tried using in product scripts and rules, but I encounter a constraint where I only appear to be able to update the record I'm in or the first one to meet the criteria.  Not all records that meet the conditions.     The full use case is simple it's SLA monitoring and notifications / alerting, this is stop gap until this hopefully arrives in V34.   

 So I'm writing out to two fields on a trigger, say when a phase starts (containment) the first being the date and time containment starts, I'm then calculating the second field based on the start value + the SLA time, then running a script to calculate the difference between the two,  writing this value to a third field and popping this onto screen for an analyst, so they become aware of the time left.  Unfortunately, I can't find away for force this to run an and update this field in the background.  I've tried a rule without criteria, but this only works on the single open incident is updated. 

 I was trying to find away to force this to be updated, say every 15 minutes, so the timer counts down in the background and then when certain conditions are meet i.e. minutes left is less than, a notification could be sent within Resilient, to remind / escalate as required. 

 I've got it working perfectly in product manually, but obviously this isn't going to help customers if they receive a incident, don't update it for several hours and then when they do, they'll could get 5 alerts simultaneously telling them they're near the SLA and have now exceeded it as they've just updated the incident, that's not going to be helpful :-) 

Any suggestions on how this could be achieved would be gratefully received. 

 Colin 

Hi Shane, 

 I've tried using in product scripts and rules, but I encounter a constraint where I only appear to be able to update the record I'm in or the first one to meet the criteria.  Not all records that meet the conditions.     The full use case is simple it's SLA monitoring and notifications / alerting, this is stop gap until this hopefully arrives in V34.   

 So I'm writing out to two fields on a trigger, say when a phase starts (containment) the first being the date and time containment starts, I'm then calculating the second field based on the start value + the SLA time, then running a script to calculate the difference between the two,  writing this value to a third field and popping this onto screen for an analyst, so they become aware of the time left.  Unfortunately, I can't find away for force this to run an and update this field in the background.  I've tried a rule without criteria, but this only works on the single open incident is updated. 

 I was trying to find away to force this to be updated, say every 15 minutes, so the timer counts down in the background and then when certain conditions are meet i.e. minutes left is less than, a notification could be sent within Resilient, to remind / escalate as required. 

 I've got it working perfectly in product manually, but obviously this isn't going to help customers if they receive a incident, don't update it for several hours and then when they do, they'll could get 5 alerts simultaneously telling them they're near the SLA and have now exceeded it as they've just updated the incident, that's not going to be helpful :-) 

Any suggestions on how this could be achieved would be gratefully received. 

 Colin 

Hi Shane, 

 I've tried using in product scripts and rules, but I encounter a constraint where I only appear to be able to update the record I'm in or the first one to meet the criteria.  Not all records that meet the conditions.     The full use case is simple it's SLA monitoring and notifications / alerting, this is stop gap until this hopefully arrives in V34.   

 So I'm writing out to two fields on a trigger, say when a phase starts (containment) the first being the date and time containment starts, I'm then calculating the second field based on the start value + the SLA time, then running a script to calculate the difference between the two,  writing this value to a third field and popping this onto screen for an analyst, so they become aware of the time left.  Unfortunately, I can't find away for force this to run an and update this field in the background.  I've tried a rule without criteria, but this only works on the single open incident is updated. 

 I was trying to find away to force this to be updated, say every 15 minutes, so the timer counts down in the background and then when certain conditions are meet i.e. minutes left is less than, a notification could be sent within Resilient, to remind / escalate as required. 

 I've got it working perfectly in product manually, but obviously this isn't going to help customers if they receive a incident, don't update it for several hours and then when they do, they'll could get 5 alerts simultaneously telling them they're near the SLA and have now exceeded it as they've just updated the incident, that's not going to be helpful :-) 

Any suggestions on how this could be achieved would be gratefully received. 

 Colin 

Hi Shane, 

 I've tried using in product scripts and rules, but I encounter a constraint where I only appear to be able to update the record I'm in or the first one to meet the criteria.  Not all records that meet the conditions.     The full use case is simple it's SLA monitoring and notifications / alerting, this is stop gap until this hopefully arrives in V34.   

 So I'm writing out to two fields on a trigger, say when a phase starts (containment) the first being the date and time containment starts, I'm then calculating the second field based on the start value + the SLA time, then running a script to calculate the difference between the two,  writing this value to a third field and popping this onto screen for an analyst, so they become aware of the time left.  Unfortunately, I can't find away for force this to run an and update this field in the background.  I've tried a rule without criteria, but this only works on the single open incident is updated. 

 I was trying to find away to force this to be updated, say every 15 minutes, so the timer counts down in the background and then when certain conditions are meet i.e. minutes left is less than, a notification could be sent within Resilient, to remind / escalate as required. 

 I've got it working perfectly in product manually, but obviously this isn't going to help customers if they receive a incident, don't update it for several hours and then when they do, they'll could get 5 alerts simultaneously telling them they're near the SLA and have now exceeded it as they've just updated the incident, that's not going to be helpful :-) 

Any suggestions on how this could be achieved would be gratefully received. 

 Colin 

Hi Colin,

I have a question about the Timer function in playbooks. How many playbooks can run simultaneously?

For example, if we have a playbook that runs for every incident with a 2-day sleep time, and we get 100-200 incidents, we'd have 200 playbook instances sleeping for 2 days. I'm concerned this might consume a lot of resources. Could this potentially cause the SOAR platform to crash if too many playbooks are running at once?

Can you provide any insights or best practices for handling this situation?

Hi Shane, 

 I've tried using in product scripts and rules, but I encounter a constraint where I only appear to be able to update the record I'm in or the first one to meet the criteria.  Not all records that meet the conditions.     The full use case is simple it's SLA monitoring and notifications / alerting, this is stop gap until this hopefully arrives in V34.   

 So I'm writing out to two fields on a trigger, say when a phase starts (containment) the first being the date and time containment starts, I'm then calculating the second field based on the start value + the SLA time, then running a script to calculate the difference between the two,  writing this value to a third field and popping this onto screen for an analyst, so they become aware of the time left.  Unfortunately, I can't find away for force this to run an and update this field in the background.  I've tried a rule without criteria, but this only works on the single open incident is updated. 

 I was trying to find away to force this to be updated, say every 15 minutes, so the timer counts down in the background and then when certain conditions are meet i.e. minutes left is less than, a notification could be sent within Resilient, to remind / escalate as required. 

 I've got it working perfectly in product manually, but obviously this isn't going to help customers if they receive a incident, don't update it for several hours and then when they do, they'll could get 5 alerts simultaneously telling them they're near the SLA and have now exceeded it as they've just updated the incident, that's not going to be helpful :-) 

Any suggestions on how this could be achieved would be gratefully received. 

 Colin