Hi Team,
I am investigating the OOB SIR notification "Security Incident Response Task Changed".
I found KB0859879 which states that the notification is processed through the "Notification for task" business rule on the sm_task table.
The KB references the method:
configProcessor.sendNotifications(current, previous, "sm.task.changed")
Based on this, I understand why I am not seeing a corresponding sir.task.changed event in Event Logs.
However, I am still trying to validate the following:
1. What specific updates trigger this notification?
- Does any update to a Security Incident Response Task trigger it?
- Or only specific field updates (for example Assigned To, Affected User, Requested By, State, etc.)?
2. In the notification recipient configuration:
- What does "Event Creator" resolve to?
(user who performed the update, task creator, assigned user, etc.)
- What user is passed through "Event Param 2"?
3. Has anyone validated the actual recipient mapping for this OOB notification in recent releases?
Any documentation, KB, community references, or testing results would be appreciated.
Thank you.
