Create incident timers and SLAs - Administrator Guide - Cortex XSIAM - Cortex

Create incident timers and SLAs - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-10-10

Danger

Before you can create an incident SLA, you must first create a timer field. A timer field can be associated with a single incident SLA.

Create an incident timer

Take the following steps to create an incident timer field:

Go to Settings → Configurations → Object Setup → Incidents and open the Fields tab.
Click New Field.
Under Field Type, select Timer.
Type a field name.
Under Tooltip, enter a description to pop-up when you hover over the field.
Under Incidents Filter, click Set Filter and define the subset of incidents for which the timer will be activated. For example, you can define timers for specific domains or incident source types.
Note
If you edit this filter after creation, the timer and associated SLA will be removed from any incident that no longer qualifies, even if the timer is already running.
Under Conditions, add filters that define when the timer will start and end. To add a pause condition to the timer, click Pause and define the pause criteria.
Under When incident is reopened, select the action that you want Cortex XSIAM to take.
Click Save.

Example 27.

The following timer measures the amount of time a security incident is waiting in New status before an analyst starts investigating.

Field	Value
Field Type	Timer
Field Name	Security incident response
Tooltip	Measure time from incident opening to analyst response.
Incidents Filter	Incident Domain = Security
Start when	Status = New
End when	Status = Under Investigation
When incident is reopened	Reset timer

Create an incident SLA

Take the following steps to create an incident SLA. You can set up multiple goals for an SLA.

Go to Settings → Configurations → Object Setup → Incidents and open the Fields tab.
Click New Field.
Under Field Type, select SLA.
Type a name to identify the SLA.
Under Tooltip, enter a description to pop-up when you hover over the field.
Under Timer, select the timer field with which to associate the SLA.
Under Goals, click Add SLA Goal.
The default goal applies to all incidents that meet the filter criteria specified in the timer field. You can set up addition goals that apply to subsets of the defined incidents.
In the SLA goal, type a goal name and set filter criteria.
In the Days, Hours, or Minutes fields, define the time conditions for to the SLA goal.
Arrange the SLA goals by dragging them in order of goal priority.
Click Save.

Example 28.

The following SLA field sets goals for analyst response times for security incidents with Critical and High severity. This SLA is based on the timer field created in the previous example. Because the timer field is set up with the filter Incident Domain = Security, this SLA will apply to security incidents only.

The first SLA goal applies to security incidents with a severity level of Critical. The SLA specifies that an analyst must respond to critical severity incidents within one hour.

The second SLA goal applies to security incidents with a severity level of High. The SLA specifies that an analyst must respond to high severity incidents within two hours.

Field	Value
Field Type	SLA
Field Name	Security incident response SLA
Tooltip	Measure time from incident opening to analyst response.
Timer	Security incident response
Goals	Name: Critical severity incidents Minutes: 60 Filter: severity = Critical
	Name: High severity incidents Minutes: 120 Filter: severity = High

Display timer and SLA fields in the Incidents page

After creating new timer and SLA fields, you can add them to the Incidents table layout and view them in the Incidents detailed view:

In the Incidents table view, add the timer and SLA fields to the Layout tab in the Table Setting Menu.
In the Incidents detailed view, use the Sort By field to filter the incident list by the SLA field. Details of the SLA are shown in the list.
In addition, you can create a custom incident layout with a new tab displaying SLA fields. For more information, see Incident layouts.

Example of SLA and timer fields

Example 29.

This example is based on the fields created in the previous procedures:

The Security incident response timer field displays the number of minutes since incident creation. When the incident status moves from New to Under Investigation, the timer stops.
The Security incident response SLA field starts counting backwards to show the remaining time to meet the SLA. If the field is shown in red with a minus time, the SLA is breached.
- For incident 001, the critical severity incident has been in New status for 5 minutes. An analyst must respond within the remaining 55 minutes.
- For incident 002, the high severity incident has been in New status for 20 minutes. An analyst must respond within the remaining 1 hour and 40 minutes.
- For incident 003, an analyst did not respond within 60 minutes and therefore the SLA was breached. The Security incident response SLA field displays a minus value and a red icon.

Incident ID	Severity	Security incident response	Security incident response SLA
001	Critical	5m	55m 25s
002	High	20m	1h 40m 30s
003	Critical	65m	- 5m 23s

Additional considerations

Consider the following information when working with timer and SLA fields: