Manage timers and SLA for a specific incident, such as
decreasing required response time for a high priority incident.
Cortex XSOAR change SLA, change timer
You can manage the timers and SLA for a specific
incident. This enables you to manage SLAs on a global level within
the SLA fields, and on a more granular level within specific incidents
when the need arises. For example, if the severity of the incident
dictates that you decrease the response time for the given incident.
You can use commands to set the SLA for a specific SLA
field in a specific incident using the
and adding the SLA field for which to set the time.
do not enter a value for the slaField parameter, the time you enter
is applied to the incident's Due Date.
following example shows you how to change the Time to Detection
field to 30 minutes for the current incident:
!setIncident sla=30 slaField=timetodetection
defining the values for the slaField and timer commands, all values
must be in lowercase and cannot have any spaces.
You can use commands to change the state of a timer for
an incident using the following:
startTimer - Starts the timer. This command
should also be used to restart a paused timer.
are not started automatically when an incident is created.
pauseTimer - Pauses the timer.
stopTimer - Stops the timer. Once a timer is stopped,
you can only reset a timer using the
are automatically stopped when an incident is closed.
resetTimer - Resets a timer. This command should be used
to enable a timer that was stopped.
The following example shows you how
to pause a timer for a specific field in the current incident:
can specify the incidentID to change the timer for a different incident.