Trigger times to start, pause, or stop when a certain task occurs in a Cortex XSOAR playbook.
Timers are specific tasks that you implement in playbooks to manage SLAs. The timers can be triggered to start, pause, or stop when a certain task occurs. For example, a timer can be triggered to stop for the Time to Assign field when the incident is assigned an owner, and to immediately start the timer for the Time to Remediation field.
Before you begin, if the playbook originates from a content pack, you need to either duplicate the playbook or detach it. If detached, the playbook does not receive content pack updates.
Navigate to the Playbooks page.
Select the playbook to which you want to add the timer and click Edit.
Click the + symbol to add a new task or click an existing task to edit the task.
In the Timers tab, select the action that you want the timer to perform for the given task. Valid options are:
Start - Starts the timer.
Note
Timers are not started automatically when an incident is created.
Pause - Pauses the timer.
Stop - Stops the timer. Once a timer is stopped, you can only reset a timer using the resetTimer command.
Note
Timers are automatically stopped when an incident is closed.
Select the field on which the timer is applied.
Click Ok.