Search
-
First response Breach after incident is resolved
-
Re: First response Breach after incident is resolved
I would love to hear if there is a fix for this, as well. In fact, if anyone knows how to script acknowledging the incident when resolving it if a first response has not been set, that would be ideal. We have way too many analysts that fail to notice an incident does not yet have a "First Response" when resolving, and it… -
Re: First response Breach after incident is resolved
First you should define your rules on how you want the SLA to be completed in a closed event. Meaning either as Met or canceled. Once you determine those rules you can update the management pack with the new rule. Note this requires direct updates to the XML. Hopefully you have a dev environment to test the building first.…