I am having correlation search running for every 5mins to get last 15mins data. The requirement is if the event comes at first time and created the episode but it should not create a incident at the time. it should wait for 15mins and then if the issue is still there then create a incident.
How we will know issue is still there, we are having auto-closure as well, for the same event if the auto-closure event comes correlate the event into the same episode and close the episode , this should happen if the auto-closure event come within 15mins. If auto-closure comes after 15mins then close the incident.
Action for raising the incident will be based on status= ACTION and for auto-closure , the status is OK.
Now, to implement this we have created the action rules in NEAP policy,
1. to stop episode creating incident for 15mins -
if the event in the episode is >=1 and status as active and if the episodes existed for 900sec--> SNOW configure
2. To close the episode after receiving status as OK within 15mins
if the event in the episode is >=2 and status in OK --> Close the episode
3. To close the episode after receiving status as OK after 15mins
if the event in the episode is >=2 and status in OK and incident_status for that episode is not resolved or closed --> Close incident in SNOW
But the tried use cases are not working, any one can help me with this how we can implement?
