Home Analyst Portal

First response Breach after incident is resolved

Andy_LeopoldAndy_Leopold Customer IT Monkey ✭
hey all, thanks for the help recently, I am now trying to stop the SLA breach warnings and breaches notices when the IR/SR are closed without Acknowledging/First Response. Any help is greatly appreciated 


  • Options
    Josh_SchmiedelJosh_Schmiedel Customer IT Monkey ✭
    I would love to hear if there is a fix for this, as well.

    In fact, if anyone knows how to script acknowledging the incident when resolving it if a first response has not been set, that would be ideal. We have way too many analysts that fail to notice an incident does not yet have a "First Response" when resolving, and it negatively affects our SLAs. 
  • Options
    Brian_WiestBrian_Wiest Customer Super IT Monkey ✭✭✭✭✭
    First you should define your rules on how you want the SLA to be completed in a closed event. Meaning either as Met or canceled. 

    Once you determine those rules you can update the management pack with the new rule. Note this requires direct updates to the XML. Hopefully you have a dev environment to test the building first. 

    Here is a blog that talks about the Pause ability http://blotenburg.azurewebsites.net/archives/401
    It should give you a guide line of what to update. Where you would be looking for the Met/Cancel rules in the MP.
Sign In or Register to comment.