Use SLA and Timer field commands manually in the CLI - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
8
Creation date
2024-02-14
Last date published
2024-04-25
Category
Administrator Guide
Solution
Cloud
Abstract

Use timers and SLA commands for a specific incident, such as decreasing the required response time for a high-priority incident.

You can manage the timers and SLA for a specific incident manually in the CLI, which enables you to manage SLAs on a global level and a more granular level within specific incidents when the need arises. For example, if the severity of the incident dictates that you decrease the response time for the given incident.

Set Timer/SLA fields

Use the setIncident command to set the SLA incident due to date or to set a specific SLA field in an incident. When adding the sla parameter to the command, it sets the time for the incident's due date. If you also add the slaField you set the SLA for the incident field.

For example, to change the Time to Assignment field to 30 minutes in the current incident:

!setIncident sla=30 slaField=timetoassignment

To change the SLA time to February 1, 2024, at 11.12 am:

!setIncident sla=2024-02-01T11:12

Note

When defining the values for the slaField use the machine name for the field, which is lowercase and without spaces. You can check the machine name by editing the incident field. For example, the Remediation SLA field is remediationsla.

Start/stop Timer/SLA fields

Use the following commands in the CLI:

Command

Description

startTimer

Starts the timer in a Timer/SLA field. For example, !startTimer timerField=timetoassginment. This command can also be used to restart a paused timer.

Note

Timer/SLA fields are not started automatically when an incident is created unless run in a playbook.

pauseTimer

Pauses the timer in a Timer/SLA field. For example, !pauseTimer timerField=timetoassignment. Use this command when a Timer/SLA field has started.

stopTimer

Stops the timer in a Timer/SLA field. For example, !stopTimer timerField=timetoassignment .After a Timer/SLA field is stopped, you can only reset a timer using the resetTimer command.

Note

Timers are automatically stopped when an incident is closed.

resetTimer

Resets a timer in a Timer/SLA field, which resets the elapsed time, and the status of the timer for the incident. This command should be used to enable a timer that was stopped. For example, !pauseTimer timerField=timetoassignment.

Note

When running the commands, you can specify the incidentID to change the timer for a different incident.