> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/slas/slas-in-cortex-xsoar.md). # SLAs in Cortex XSOAR SLAs are an important aspect of case management in Cortex XSOAR. SLAs enable you to define specific goals and responsibilities and improve quality and availability. Analysts can prioritize incidents and ensure that those incidents are handled efficiently. Managers can see an overview of those incidents, improve reaction time, and measure success. You can do the following: | Action | Description | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Define SLAs in incident types and fields |

Incorporate SLAs into your incidents to set how long an action should take. SLAs are not enforced inherently, but can be configured to be acted upon by the user. You can view how much time is left before the SLA becomes due, as well as configure actions to take if the SLA passes its due date.

You can define an SLA in an incident type, which occurs when the incident is created. These global settings apply when the incident opens until closed. Some out-of-the-box incident types have the SLA defined by default. For more information, see Configure an SLA in an incident type.

You can also define an SLA in an incident field for more granular control, such as setting the time to assign an incident. For more information, see Configure Timer/SLA fields.

When set up, you can see the SLAs for the incident type and incident fields in the incident table and incident layout.

| | Set up Timers |

Timer incident fields can be started, stopped, or paused in a playbook, script, or manually in the CLI. These fields give you granular control when tracking the response to a given incident. For example, the Time to Assignment incident field tracks the time to assign an incident that can be started, stopped, or paused.

Note

Timers measure how much time has passed since the event. SLAs measure how much time is left until the event.

| #### SLA scripts You can use SLA scripts to act on breaches, such as sending an email when a breach occurs, or specific changes to an incident field, such as a change of incident owner. Cortex XSOAR includes out-of-the-box scripts or you can create your own script. For more information, see [Automate changes to incident fields using SLA scripts](/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/slas/automate-changes-to-incident-fields-using-sla-scripts.md). #### Using the CLI If you want to set or change the SLA for an incident type or field you can use the `setIncident` command in the CLI. For timers, you can use commands such as `startTimer`, `stopTimer`, and `pauseTimer`. For more information, see [Use SLA and Timer field commands manually in the CLI](/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/slas/use-sla-and-timer-field-commands-manually-in-the-cli.md). #### Incident layouts When you configure the Timer/SLA fields, you can add them to your incident layout to view the status of the SLA, if any of the SLAs are overdue, and if so, by how much. You can also view the number of cases that are at risk of passing the SLA or are already late. You can set the risk threshold for each incident field or rely on the default setting, which is 72 hours. You can change the default threshold by adding a server configuration. See [Configure the Global Risk Threshold](/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/slas/configure-the-global-risk-threshold.md). #### Dashboards Cortex XSOAR comes out-of-the-box with an SLA dashboard, where you can view SLA information, such as within SLA by type, late SLA by type, mean time to resolution, etc. You can also generate reports such as late incidents, open incidents, etc. #### Further resources Watch the following video to see how to set up SLA/Timers in your use case: [SLAs and Timers](https://www.youtube.com/watch?v=AznS-Rn_fLg). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.7/configure-cortex-xsoar/slas/slas-in-cortex-xsoar.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.