> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/issue-timer-fields.md).

# Configure issue timer fields

Configure Cortex XSIAM issue timer fields to track response times, SLAs, risk thresholds, and timeout automation.

Configure Cortex XSIAM issue timer fields to track issue response times, service-level agreements (SLAs), and timeout targets. Timer fields are disabled by default. To enable them, go to **Settings** → **Configurations** → **General** → **Server Settings** → **Issues**, then enable **Timer Field**.

Timer fields track reaction times and issue-level metrics. Use separate timers for different stages. For example, track time since the first playbook ran or time waiting for a user response. Timers appear in the **Issues** table and issue layouts.

Start, stop, or pause timer fields with a playbook, script, or the CLI.

Timer fields count up from the start of an action or task. They can also count down to a target. Configure a risk threshold to identify timers at risk.

Running timers show their total duration. At-risk timers show an at-risk status. Timed-out fields show the total duration and the time past the target.

Timer fields do not trigger actions automatically when they time out. Configure a timer script to run when a timeout occurs.

### Automate issue timer timeouts with scripts

Use scripts to act on timeouts, such as sending an email. Scripts can also change an issue field or parent case, such as its owner. Cortex XSIAM includes out-of-the-box scripts, or you can create your own. Scripts must use the `SLA` tag to work with timer fields. For more information, see [Automate changes to issue fields using timer scripts](/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/automate-changes-to-issue-fields-using-timer-scripts.md).

### Manage issue timers with the CLI

Use the `setIssue` command in the CLI to set or change issue timers. You can also use commands such as `startTimer`, `stopTimer`, and `pauseTimer`. For more information, see [Use issue timer field commands in the CLI](/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/user-issue-timer-field-commands-manually-in-the-cli.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/customize-issue-fields-and-layouts/issue-fields/issue-timer-fields.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.