> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md). # Create additional case timers and SLAs To help you to monitor and assess your key performance indicators (KPIs), you can create SLAs at the case level. Case SLAs provide the ability to track KPIs, obtain real-time insights into operational performance, and ensure alignment with established objectives. {% hint style="info" %} **Tip** You don't need to build a resolution SLAs and timers from scratch. The following built-in fields are available in the **Cases** table: * **Resolution Timer:** Works automatically out-of-the-box to measure elapsed case duration. * **Resolution SLA:** Pre-positioned in the system, but requires you to configure your specific time goals to begin tracking compliance. For more information, see [Create SLAs for case and issue resolution](/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution.md). {% endhint %} In addition to the default **Resolution Timer** and **Resolution SLA** fields, you can create additional timer and SLA fields to measure separate milestones, such as initial response times, or to enforce unique targets for specific customer tiers. All active case SLAs are displayed in the case header. Case SLAs are based on case timer fields. When a case matches the defined criteria, the timer starts running. If the timer field is linked to an SLA, the progress of the case is tracked in relation to the SLA. Note that the timer field counts forward, and the SLA field counts backwards. {% hint style="warning" %} ### Prerequisite Before you can create a case SLA, you must first create a timer field. A timer field can be associated with a single case SLA. {% endhint %}
Create a case timer Take the following steps to create a case timer field: 1. Go to **Settings** → **Configurations** → **Object Setup** → **Case** and open the **Fields** tab. 2. Click **New Field**. 3. Under **Field Type**, select **Timer**. 4. Type a field name. 5. Under **Tooltip**, enter a description to pop-up when you hover over the field. 6. Under **Case Filter**, click **Set Filter** and define the subset of cases for which the timer will be activated. For example, you can define timers for specific domains or case source types.

Note

If you edit this filter after creation, the timer and associated SLA will be removed from any case that no longer qualifies, even if the timer is already running.

7. Under **Conditions**, add filters that define when the timer will start and end. To add a pause condition to the timer, click **Pause** and define the pause criteria. 8. Under **When case is reopened**, select the action that you want Cortex XSIAM to take. 9. Click **Save**. The following timer measures the amount of time a security case is waiting in **New** status before an analyst starts investigating. | Field | Value | | --------------------- | --------------------------------------------------- | | Field Type | Timer | | Field Name | Security case response | | Tooltip | Measure time from case opening to analyst response. | | Cases Filter | Case Domain = Security | | Start when | Status = New | | End when | Status = Under Investigation | | When case is reopened | Reset timer |
Create a case SLA field Take the following steps to create a case SLA. You can set up multiple goals for an SLA. 1. Go to **Settings** → **Configurations** → **Object Setup** → **Cases** and open the **Fields** tab. 2. Click **New Field**. 3. Under **Field Type**, select **SLA**. 4. Type a name to identify the SLA. 5. Under **Tooltip**, enter a description to pop-up when you hover over the field. 6. Under **Timer**, select the timer field with which to associate the SLA. 7. Under **Goals**, click **Add SLA Goal**. The default goal applies to all cases that meet the filter criteria specified in the timer field. You can set up addition goals that apply to subsets of the defined cases. 8. In the SLA goal, type a goal name and set filter criteria. 9. In the **Days**, **Hours**, or **Minutes** fields, define the time conditions for to the SLA goal. 10. Arrange the SLA goals by dragging them in order of goal priority. 11. Click **Save**. The following SLA field sets goals for analyst response times for security cases with Critical and High severity. This SLA is based on the timer field created in the previous example. Because the timer field is set up with the filter **Case Domain = Security**, this SLA will apply to security cases only. The first SLA goal applies to security cases with a severity level of **Critical**. The SLA specifies that an analyst must respond to critical severity cases within one hour. The second SLA goal applies to security cases with a severity level of **High**. The SLA specifies that an analyst must respond to high severity cases within two hours. | Field | Value | | ---------- | ------------------------------------------------------------------------------------------------------- | | Field Type | SLA | | Field Name | Security case response SLA | | Tooltip | Measure time from case opening to analyst response. | | Timer | Security case response | | Goals | | | | |
Display case timer and SLA fields in the Cases page After creating new timer and SLA fields, you can add them to the **Cases** table layout and view them in the **Cases** detailed view: * In the **Cases** table view, add the timer and SLA fields to the **Layout** tab in the **Table Setting Menu**. * In the **Cases** detailed view, use the **Sort By** field to filter the cases list by the SLA field. Details of the SLA are shown in the list. In addition, you can create a custom case layout with a new tab displaying SLA fields. For more information, see [Case layouts](#UUID-3ab0c823-5093-6278-3105-a12c989beedf).
Example of SLA and timer fields This example is based on the fields created in the previous procedures: * The **Security case response** timer field displays the number of minutes since case creation. When the case status moves from **New** to **Under Investigation**, the timer stops. * The **Security case response SLA** field starts counting backwards to show the remaining time to meet the SLA. If the field is shown in red with a minus time, the SLA is breached. * For case 001, the critical severity case has been in **New** status for 5 minutes. An analyst must respond within the remaining 55 minutes. * For case 002, the high severity case has been in **New** status for 20 minutes. An analyst must respond within the remaining 1 hour and 40 minutes. * For case 003, an analyst did not respond within 60 minutes and therefore the SLA was breached. The **Security case response SLA** field displays a minus value and a red icon. | Case ID | Severity | Security case response | Security case response SLA | | ------- | -------- | ---------------------- | --------------------------------------------------------- | | 001 | Critical | 5m | 55m 25s ![SLA\_timer.png](/files/C6fkvFTdUObxx27f1Wrq) | | 002 | High | 20m | 1h 40m 30s ![SLA\_timer.png](/files/C6fkvFTdUObxx27f1Wrq) | | 003 | Critical | 65m | - 5m 23s ![SLA\_breach.png](/files/VsFvHQxEoYUPbtGPAdCU) |
Additional considerations Consider the following information when working with timer and SLA fields: * When a case is resolved, the timer calculation stops. * Updating timer logic affects open and new cases. Therefore, the timer and associated SLA will be removed from any case that no longer qualifies, even if the timer is already running. * If you delete a timer field, the SLA associated to the timer is also deleted.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cases-and-issues/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.