Thanks cdtj, using "sync_fetch" with "MLIST_STATIC" was the key for the solution. I had a task to implement notification on incident closure, when end user leaves comment. All other closures by analyst or auto close needs to be omited. Here are the condition macro that seems to solve the problem
if (cnt::get_login_user_interface_type() == 1 && type == 'I')
{
object pointer;
send_wait(0,top_object(),"call_attr","alg","sync_fetch","MLIST_STATIC", format("call_req_id = '%s' AND type = 'CL'", persistent_id),-1,0);
if (msg_error())
{
logf(ERROR,"Error in sync_fetch '%s'", msg[0]);
return (-4);
}
else
{
send_wait(0, msg[0], "dob_by_index", "DEFAULT", msg[1]-1, msg[1]-1);
if (msg_error())
{
logf(ERROR,"Error in dob_by_index '%s'", msg[0]);
return (-4);
}
else
{
pointer = msg[0];
logf(TRACE,"Evaluated log entry id is %d description: '%s'", pointer.id, pointer.description);
if (pointer.description != pointer.action_desc)
{
logf(TRACE,"Evaluated to True");
set_return_data(TRUE);
}
else
{
logf(TRACE,"Evaluated to False");
set_return_data(FALSE);
}
}
}
}
else
{
logf(TRACE,"Evaluated to False");
set_return_data(FALSE);
}