> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/configure-a-playbook-to-run-timersslas.md).

# Configure a playbook to run Timers/SLAs

To run a timer, it must be run in a playbook task, a script, or manually in the CLI.

You can set a Timer/SLA field to start running by doing the following:

* In a Timer/SLA field such as the `Time To Assignment` field, you can control all incidents that use the field regardless of the playbook configured for them by configuring a script to run when the Owner field changes.. This method automatically stops the timer when an analyst is assigned. See [Automate changes to incident fields using SLA scripts](/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/automate-changes-to-incident-fields-using-sla-scripts.md). The advantages of using this option are scalability and consistency.
* Stop the field through a playbook. The Timer/SLA field can be triggered to start, pause, or stop when a certain task occurs. For example, a timer can be triggered to stop for the **`Time to Assign`** field when the incident is assigned an owner, and to immediately start the timer for the **`Time to Remediation`** field.

In a playbook, you add timers to specific tasks to manage SLAs.

When defining a Timer in a task or section header, in the Timers tab, select the action that you want the timer to perform for the task.

{% hint style="info" %}

### Note

If creating tasks for SLAs they do not have to execute anything. You can also use section headers.
{% endhint %}

Valid options are:

| Option        | Description                                                                                                                                                                                                                                                                                                                    |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Timer.start` | <p>Starts the timer.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Timers are not started automatically when an incident is created.</p></div>                                                                                                          |
| `Timer.pause` | Pauses the timer.                                                                                                                                                                                                                                                                                                              |
| `Timer.stop`  | <p>Stops the timer.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Timers are automatically stopped when an incident is closed. After a timer is stopped, you can only reset a timer using the <strong>resetTimer</strong> command in the CLI.</p></div> |

Some playbooks, such as **Phishing - Generic v3**, comeout-of-the-box with SLA timer tasks included. If you need the same timers across use cases, create a sub-playbook based on your use case or conditions such as incident severity.

Although you can create your own SLA sub-playbooks, the **CaseManagement - Generic** content pack includes several SLA playbooks, which you can configure. For more information, see the [CaseManagement - Generic](https://cortex.marketplace.pan.dev/marketplace/details/CaseManagementGeneric/) content pack.

<details>

<summary>The Case Management - Generic - Start SLA Timers playbook</summary>

The **Case Management - Generic - Start SLA Timers** playbook starts the Time to Assignment or Remediation SLA timers field based on whether an owner is assigned to the Incident. You can add this as a sub-playbook to your use case.

![sla-playbook.png](/files/dsxjxhWYWR5tS45UKbNm)

{% hint style="info" %}

### Note

When a task or section has a Timer/SLA action configured, it displays the hourglass icon.
{% endhint %}

1. The first task is a conditional task which determines whether an `incident.owner` has been assigned.

   ![sla-timer1.png](/files/dNosmU5digtP9nDy0Gps)
2. On the left-hand side task, if no owner is assigned the **Time to Assignment** timer starts.

   The **Print** script returns details to the War Room confirming that the script has started to run.

   ![sla-timer3.png](/files/V6l4RSw5v3Vvbr1Kwhvw)
3. On the right-hand side task, if an owner is assigned the Remediation SLA timer starts.

   ![sla-timer2.png](/files/ZDYkE90yEzz89YOf3xbI)

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you want to stop or pause a timer in a playbook, you can use an existing or create a section header/task. When you select <strong>Timer.stop</strong>, the run is considered finished and cannot be restarted without setting it to zero. If you want to restart the timer, select <strong>Timer.pause</strong> so you do not lose the accumulated time. By default, all timers stop when the incident closes.</p></div>

Add the sub-playbook to the main playbook, as required.

</details>

<details>

<summary>Case Management - Generic - Set SLAs based on Severity playbook</summary>

This playbook sets the SLAs for incidents, the Time to Assignment Timer, and the Remediation SLA Timer based on the incident severity using playbook inputs. For example, set the number of minutes for incident and remediation SLAs for critical incidents. For more information, see [Case Management - Generic - Set SLAs based on Severity](https://xsoar.pan.dev/docs/reference/playbooks/case-management---generic---set-sl-as-based-on-severity). Add this as a sub-playbook to your use case.

Alternatively, create a playbook or script to modify SLA fields based on certain conditions. For example, in the Set Severity to Medium task, you can add an SLA such as Time to Assignment 15 minutes where there is high severity (3).

![sla-severity.png](/files/7vC87yKdrkJILtPzLpzw)

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas/configure-cortex-xsoar/slas/configure-a-playbook-to-run-timersslas.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.