Issue with Duration Calculations on sn_si_incident Table for Closed Incidents

[Nilam Narote]

Hi Community,

I'm currently working with the Security Incidents table (sn_si_incident) and have encountered an issue related to duration calculations.

What I'm trying to do:

• Access the sn_si_incident table

• Filter the list to show only closed incidents

• Display the Duration and Business Duration columns in the list view

The problem:

Despite incidents being in a closed state, both the Duration and Business Duration fields are not showing the expected values—they appear to be blank or not calculated correctly.

Has anyone experienced this before? Is there something additional that needs to be configured or triggered for the duration fields to populate for closed incidents in this table?

Any guidance or suggestions would be appreciated.

Thanks in advance!

[Abhijit4]

Hi @Nilam Narote 

Business Duration/Duration fields are part of Task table. However, almost on all table you would see its value as blank except Incident (incident) table as there is OOTB business rule "mark_closed" on Incident table which calculates this duration.

If you want to make it work for sn_si_incident as well then you can create similar BR on Security Incident table.

[Nilam Narote]

Thanks @Abhijit4