Issue timer fields count up from when a specific event begins and can also count down to a deadline. You can trigger actions in the event the issue timer field is breached.
By default, timer fields are disabled in Cortex XSIAM. To enable timer fields, go to → → → → and Enable Timer Field.
Timer issue fields provide you with the ability to track reaction time and help you measure issue-level metrics. Timers can measure multiple aspects of an issue. You can, for example, have a timer track how long since the first playbook ran, and have another timer track how long you've been waiting for a user's response. Timers display in the issues table and in issue layouts.
Timer fields can be started, stopped, or paused in a playbook, script, or manually in the CLI.
Timer fields count up from when a specific action or task began and also (optionally) count down from a target. The Risk Threshold tells you when a timer is considered at risk and you can customize the time period for the Risk Threshold.
Timer fields always show the total duration while they are still running. If they are at risk, they show the at risk status. After a timer field has timed out (passed the target), the timer shows both the total duration and how long past the target.
Timer fields do not automatically trigger actions when timers time out. You can configure a script to run when a timer times out.
You can run scripts to act on timeouts, such as sending an email when a timeout occurs. You can also make specific changes to an issue field or a parent case issue, such as changing the case owner. Cortex XSIAM includes out-of-the-box scripts or you can create your own scripts. Scripts must have the SLA tag to be used for timer fields. For more information, see Automate changes to issue fields using timer scripts.
If you want to set or change timers for an issue you can use the setIssue command in the CLI. You can also use commands such as startTimer, stopTimer, and pauseTimer. For more information, see Use issue timer field commands manually in the CLI.