Create an SLA Trigger

Trigger times to start, pause, or stop when a certain task occurs in a Cortex XSOAR playbook. SLA playbooks, trigger Timer playbooks
Timers are specific tasks that you implement in playbooks to manage SLAs. The timers can be triggered to start, pause, or stop when a certain task occurs. For example, a timer can be triggered to stop for the
Time to Assign
field when the incident is assigned an owner, and to immediately start the timer for the
Time to Remediation
  1. Navigate to the
  2. Select the playbook to which you want to add the timer and click
  3. Click the + symbol to add a new task or click an existing task to edit the task.
  4. In the Timers tab, select the action that you want the timer to perform for the given task. Valid options are:
    • Start - Starts the timer.
      Timers are not started automatically when an incident is created.
    • Pause - Pauses the timer.
    • Stop - Stops the timer. Once a timer is stopped, you can only reset a timer using the
      Timers are automatically stopped when an incident is closed.
  5. Select the field on which the timer is applied.
  6. Click

Recommended For You