How to implement SLA for analyst assignment in Google SecOps?

Question

Hello,I’m trying to implement an SLA workflow for Cases in Google SecOps, specifically around analyst assignment and investigation timing, and I’d appreciate guidance on best practices.From what I can see today, at the system level, Google SecOps provides:	Alert Stage			Severity	However, there is no native SLA mechanism for:	Time to analyst assignment (Owner)			Time spent in specific case phases (Triage / Investigation)	SLA logic I’m trying to enforceMy desired SLA flow is: Case created (Unassigned) → Triage: 30 minutes to assign an analyst → Assigned → 15 minutes to move to Investigation → Investigation → 1 hour to progress / respond  	What is the recommended way to implement SLA tracking for:			Analyst assignment					Is the expected approach to use:			Case-based Rules?						Tags / labels?						External reporting (e.g., BigQuery)?					Are there any product roadmap plans for native SLA support on Cases?	Any guidance, documentation, or real-world implementation examples would be greatly appreciated.Thanks in advance.

cmorris · Accepted Answer

So tracking Mean Time to Assign? This native Dashboard query should show MTTA across your cases:

stage stage1{
$case_id = case_history.case_response_platform_info.case_id
match:
    $case_id
outcome:
    $case_assign_time = min(if(case_history.case_activity = "ASSIGNEE_CHANGE", case_history.event_time.seconds, 9999999999999999))
    $status = array_distinct(case_history.case_activity)
    $TTA = $case_assign_time - min(case_history.event_time.seconds)

condition:
    arrays.contains($status, "CREATE_CASE") and arrays.contains($status, "ASSIGNEE_CHANGE") 
    }
outcome:
    $case_count = count($stage1.case_id)
    $MTTA = avg($stage1.TTA)/60

kentphelps · Answer

Take a look at these to see if they are of any help:Set SLA expectationsSOAR Dashboards overview | Google Security OperationsSOAR Production Monitoring

SLA logic I’m trying to enforce

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded