Watchlist Notifications Query - Non Runbook

Sean_Terry

Seen various threads and wondered if anyone had notifications set up that didn't involve an Orchestrator runbook triggering on every analyst comment. Just wondering if there was a more efficient way of doing it. It seems like something that a small group would find very useful but to trigger it for every comment seems a bit inefficient. Hoping there is another way.

Brett_Moffett

Hi @Sean_Terry

It might seem inefficient to trigger an action on ALL analyst comments just to trap the few that have been tagged on someone's Watchlist, however, there is no way to filter to only those items that have a Watch List relationship first.

Depending on the query used, it should be very fast to register that IR12345 just had a comment added, it was an Analyst comment, then look at does that IR have a relationship to a watchlist. If no, stop. If yes, send the notification to .... and so forth.

Doing this in Orchestrator would be the biggest slow down point.

Having it in PowerShell and placing it in to a workflow within SCSM would mean there would be no monitoring per-se but rather the Workflow engine in SCSM would trigger it when it saw an analyst comment.

If you have someone who can write .NET then you could streamline the code even further to really squeeze the performance out of it, but I would suggest doing it in PowerShell and creating a workflow management pack would be the way to go.

In addition, putting in a feature request for the Notify Analyst app to include Watchlist items might get enough support from others in the community to get that feature added. (No promises)

Hope this helps

Brett