For example, we send an incident by mail via IBM Security Qradar SOAR. However, if there is no response to this e-mail within two days, we want to send a reminder e-mail. Is there an article or a text to guide on this topic? How can we do this?
This should be doable using the timer events.
Can you please check out this documentation?
First of all, thanks for your return. We designed a workflow using the Timer function. Here, for example, SOAR will send the reminder email after 24 hours, but the person in question replied at the 15th hour, so we don't need to send the reminder email. In the remaining 9 hours, this timer function will have worked in vain in the background. What kind of control mechanism should be put in order to prevent this? Do you have a comment?