> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-slas-for-issue-resolution.md).

# Create SLAs for case and issue resolution

Create Cortex XSIAM resolution SLA rules to set, track, and report case and issue resolution time goals and timers.

Create Cortex XSIAM resolution SLAs to set time-based goals for case and issue resolution. Service Level Agreements (SLAs) define expected service levels between teams or service providers. Resolution timers track the time required to resolve cases and issues.

### Why use Cortex XSIAM resolution SLAs?

Resolution SLAs give analyst teams a framework for prioritizing remediation. Key benefits include:

* **Meet compliance requirements:** Regulatory frameworks, such as PCI or HIPAA, mandate timely issue resolution. For example, PCI may require critical issues be fixed within a month, while HIPAA sets a 15-day limit for critical findings.
* **Manage risk for critical assets:** Organizations set SLAs based on the sensitivity and criticality of assets. For example, a hospital would prioritize fixing issues impacting patient medical records or payment systems over non-essential displays.
* **Report and measure remediation efforts**: SLAs allow leadership to track the effectiveness of security programs and report progress toward the goal of zero SLA violations.

### Create a Cortex XSIAM resolution SLA rule

To configure a resolution SLA for cases or issues, create an SLA rule that defines:

* A time-based goal.
* The specific cases or issues the goal applies to.

Once created, the SLA rule is automatically applied to all matching existing and future cases or issues.

#### Create a resolution SLA rule

1. Select **Settings** → **Configurations** → **Object Setup** → **Cases** or **Issues**.
2. Select the **SLA Rules** tab.
3. Select **Create SLA Rule**.
4. Provide the following information, and then click **Next**.
   * **SLA Rule Name**
   * **Description** (optional)
   * **SLA Goal**: Define the SLA goal, which is the maximum time allowed to resolve issues. SLAs must be at least 30 minutes.
5. Define criteria to identify the cases or issues that the SLA will apply to.
   1. Select the filter icon to define which cases or issues this SLA rule applies to.

      <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Warning</strong></p><p>If no criteria are defined, the rule doesn’t match any cases or issues.</p></div>
   2. Review the list of cases or issues that match your filtering criteria. If the list is correct, select **Next**.
6. On the **Summary** page, review the information about the new SLA rule. If it is correct, click **Done**.

   The new SLA rule will appear in the table on the **SLA Rules** tab.
7. Set the order of evaluation for the new SLA rule. The first SLA rule that matches a case or issue will be the rule that applies to the relevant (case or issue) Resolution SLA.

   By default new SLA rules are added to the bottom of the list. To move a rule up or down in the list, click and hold the arrows in the **Name** column and drag the rule to the desired position in the list.

### Reorder Cortex XSIAM resolution SLA rules

SLA rule order is important. Rules use a stop-on-first-match evaluation. The first rule matching an issue determines its SLA. When you reorder rules, existing issues matching a higher-priority rule use the new SLA.

1. Navigate to **Settings** → **Configurations** → **Object Setup** → **Cases** or **Issues** and select the **SLA Rules** tab.
2. Change the order of the SLA rules by dragging the table rows into place. To drag a table row, click and hold an arrow in the **Name** column and drag the row to the desired position in the table.

### Monitor Cortex XSIAM resolution SLA status

Use the following resolution SLA fields on the **Cases** and **Issues** pages to filter and sort issues:

* **Resolution SLA**: Indicates the amount of time left to meet the SLA deadline. Also indicates the amount of time past the SLA deadline for issues that are overdue.
* **Resolution Timer**: Indicates how long it took to resolve the issue. The timer starts when the issue status is New, and stops when the issue status is changed to Resolved.

#### Monitor case resolution SLA status

Monitor case resolution SLA status in a case header or the cases table.

{% hint style="info" %}
**Tip**

The case header shows all active SLAs. In addition to the built-in resolution SLA, you can create SLAs for separate milestones. For more information, see [Create additional case timers and SLAs](/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-slas-for-issue-resolution/create-case-timers-and-slas.md).
{% endhint %}

1. Navigate to **Cases & Issues → Cases**, click **Display** and select **Table**.
2. Filter on **Resolution SLA > 0** or **Resolution Timer > 0** to find cases that are within the SLA.\
   These filters support filtering of whole days only, for example **Resolution SLA > 1** filters for cases that have a Resolution SLA of greater than one day.
3. Filter on **Resolution SLA < 0** or **Resolution Timer < 0** to find cases that have exceeded the SLA.

#### Monitor issue resolution SLA status

1. Navigate to **Cases & Issues** → **Issues**.
2. Filter on **Resolution SLA > 0** or **Resolution Timer > 0** to find issues that are within the SLA.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>These filters support filtering of whole days only, for example <strong>Resolution SLA > 1</strong> filters for issues that have a Resolution SLA of greater than one day.</p></div>
3. Filter on **Resolution SLA < 0** or **Resolution Timer < 0** to find issues that have exceeded the SLA.

You can also view the issue resolution SLA widgets on the **Vulnerability Management** dashboard.

Resolution SLA and resolution timer are filterable XQL fields. Their XQL schemas include derived fields. Use them to build queries, correlation rules, and dashboards that track SLA compliance.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/create-slas-for-issue-resolution.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.