Service Level Agreement

LAST UPDATED: JAN 7, 2024

The SLA module enables users to define, monitor, and enforce service-level commitments. Users can configure conditions to trigger SLA timers and fine-tune time goals to automate alerts both when an SLA is nearing a breach and after a breach occurs.

Initial SLA Setup

Navigating to the SLA Module
1. Click on the Configuration navigation link.
2. Click on the SLA module ( icon ) within the left sidebar.
Click on one of the + Add SLA buttons.
Name this SLA, then click on the Save button.
Click on the newly created entry within the SLA table.

SLA Timing Conditions

The SLA Timing Conditions section allows users to define when the SLA timer starts, pauses, and finishes based on evaluation options of matched incidents (see Conditions).

SLA Timing Trigger Dropdowns

SLA Timing Conditions:

Start Counting Time When: Specifies the condition that triggers the SLA timer to begin.

Pause Counting Time When: Defines the condition under which the SLA timer pauses, allowing flexibility for situations requiring temporary halts.

Finish Counting Time When: Sets the condition that marks the completion of the SLA timer.

Available Evaluation Options (Dropdown Menu Items):

Incident Created: Trigger based on the incident creation time.
Incident Title Contains: Trigger based on keywords in the incident title.
Incident Status First Time Changed to: Trigger when the incident status changes to a specific value for the first time.
Incident Owner's Groups Contain: Trigger based on keywords contained in the names of the groups associated with the incident owner.
Incident Owner's Role Contain: Trigger based on keywords contained in the names of the roles associated with the incident owner.
Incident Stage Contains: Trigger based on the most recent stage of an investigation playbook that the incident has reached.
Incident First Time Closed: Trigger when the incident is closed for the first time.
Incident Owner Full Name Contain: Trigger when the full name of the incident owner contains a specified value or keyword.
Incident Status Changed to: Trigger when the incident status changes to a specific value.
Incident Tags Contain: Trigger when the incident includes a specific tag.

Time Goals Configuration

If the finish counting time is within the user’s defined time target, the incident response is considered compliant. If it exceeds the target, it is classified as a breach.

The time goal section includes the following features:

Goal Name: A unique and descriptive name for easy identification of the time goal.
Time Target: The duration (minutes, hours, or days) within which the SLA timer must conclude to avoid a breach.
Alerts: The initial and follow-up alerts for when an SLA is approaching a breach or after a breach occurs. If both slider handles on the alert timeline overlap, the alert will trigger only once.
Conditions: The criteria used to match incidents to this time goal.
- If no conditions are defined, newly created incidents in the formal vSOC release will be matched to this time goal.
- Adding more conditions reduces the range of incidents that qualify for this SLA time goal.