> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/manage-sla-and-timer-fields-in-an-incident.md). # Manage SLA and Timer Fields in an Incident Manage incident SLA and timer fields in Cortex XSOAR 6.15. You can manage the timers and SLA for a specific incident. This enables you to manage SLAs on a global level within the SLA fields, and on a more granular level within specific incidents when the need arises. For example, if the severity of the incident dictates that you decrease the response time for the given incident. 1. SLA Fields You can use commands to set the SLA for a specific SLA field in a specific incident using the **setIncident** command and adding the SLA field for which to set the time. If you do not enter a value for the slaField parameter, the time you enter is applied to the incident's Due Date. **Example** The following example shows you how to change the Time to Detection field to 30 minutes for the current incident: `!setIncident sla=30 slaField=timetodetection`

Note

When defining the values for the slaField and timer commands, all values must be in lowercase and cannot have any spaces.

2. Timer Fields You can use commands to change the state of a timer for an incident using the following: * **startTimer** - Starts the timer. This command should also be used to restart a paused timer.

Note

Timers are not started automatically when an incident is created.

* **pauseTimer** - Pauses the timer. * **stopTimer** - Stops the timer. Once a timer is stopped, you can only reset a timer using the **resetTimer** command.

Note

Timers are automatically stopped when an incident is closed.

* **resetTimer** - Resets a timer. This command should be used to enable a timer that was stopped. **Example** The following example shows you how to pause a timer for a specific field in the current incident: `!pauseTimer timerField=timetodetection` You can specify the incidentID to change the timer for a different incident. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.15/customize-cortex-xsoar/customize-and-configure-cortex-xsoar/work-with-slas/manage-sla-and-timer-fields-in-an-incident.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.