Create a security incident response SLA

Define aService Level Agreement (SLA) for security incident response.

Before you begin

Role required: sn_si.admin


  1. Navigate to Security Incident > Administration > SLAs.
  2. Click New.
  3. Fill in the form, as appropriate.
    Table 1. SLA Definition form
    Field Description
    Name An identifying name for the SLA.
    Type The type of agreement being defined: SLA, OLA, or Underpinning contract. This is used for informational purposes and does not affect the behavior of the SLA.
    Table The table whose records will be tracked by this SLA. This must be a table that extends the Task table, such as Incident [incident].
    Workflow The SLA workflow that determines what activities occur in response to the SLA. Workflows are typically used to create events which send off notifications.
    Enable logging Check box to enable logging for before and after values when updating an SLA using this definition.
    Duration type Whether a user-specified duration or a relative duration such as End of next business day is used to calculate the duration of the SLA.
    Duration The length of time the SLA runs before it is marked as breached.

    These fields appear when User specified duration is selected from the Duration type list.

    Relative duration works on Whether task or SLA records are used to calculate the relative duration.

    These fields appear when a relative duration is selected from the Duration type list.

    Schedule The hours during which the SLA timer runs. The schedule can be taken from SLA definitions or from CIs, as defined on the SLA Engine properties page.

    Timezone Used in conjunction with the Schedule field. The time zone is used to determine when work has failed to be performed within the terms of the SLA (that is, the SLA has breached).
    Start condition, Stop condition, Pause condition, Reset condition Conditions for starting, stopping, pausing, and resetting the SLA. These conditions control the process flow for created SLAs. For example, when the Start condition is met, an SLA record is attached to the relevant task, and the SLA timer then starts.
  4. Click Submit.


Figure 1. Sample SLA Definition
Sample SLA Definition