Use SLA and Timer field commands manually in the CLI - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Cortex XSOAR
Creation date
Last date published
Administrator Guide

Use timers and SLA commands for a specific incident, such as decreasing the required response time for a high-priority incident.

You can manage the timers and SLA for a specific incident manually in the CLI, which enables you to manage SLAs on a global level and a more granular level within specific incidents when the need arises. For example, if the severity of the incident dictates that you decrease the response time for the given incident.

Set Timer/SLA fields

Use the setIncident command to set the SLA incident due to date or to set a specific SLA field in an incident. When adding the sla parameter to the command, it sets the time for the incident's due date. If you also add the slaField you set the SLA for the incident field.

For example, to change the Time to Assignment field to 30 minutes in the current incident:

!setIncident sla=30 slaField=timetoassignment

To change the SLA time to February 1, 2024, at 11.12 am:

!setIncident sla=2024-02-01T11:12


When defining the values for the slaField use the machine name for the field, which is lowercase and without spaces. You can check the machine name by editing the incident field. For example, the Remediation SLA field is remediationsla.

Start/stop Timer/SLA fields

Use the following commands in the CLI:




Starts the timer in a Timer/SLA field. For example, !startTimer timerField=timetoassginment. This command can also be used to restart a paused timer.


Timer/SLA fields are not started automatically when an incident is created unless run in a playbook.


Pauses the timer in a Timer/SLA field. For example, !pauseTimer timerField=timetoassignment. Use this command when a Timer/SLA field has started.


Stops the timer in a Timer/SLA field. For example, !stopTimer timerField=timetoassignment .After a Timer/SLA field is stopped, you can only reset a timer using the resetTimer command.


Timers are automatically stopped when an incident is closed.


Resets a timer in a Timer/SLA field, which resets the elapsed time, and the status of the timer for the incident. This command should be used to enable a timer that was stopped. For example, !pauseTimer timerField=timetoassignment.


When running the commands, you can specify the incidentID to change the timer for a different incident.