Hi Everyone,
I’m working on setting up SLA rules in Chronicle SOAR for cases, and I’ve run into some challenges that I’d like to get your input on. Here’s the scenario:
Requirements:
-
First response SLA: Starts when a case is created and stops when the case is assigned or moves out of the Triage stage and period 1 hours.
-
Update SLA: Starts after the case moves out of Triage and resets whenever there’s an update in the case wall and duration is specific to Severity. Stops when the case is closed.
The challenge is chronicle doesn’t appear to have a direct SLA reset mechanism to restart timers whenever there’s a casewall update.- using the "Get Case Communications" Siemplify Action Module be a viable workaround to detect updates and restart SLA timers dynamically? Has anyone successfully implemented something similar?
Timer Start for SLA: The response SLA starts when the case is created, but the Update SLA needs to start when the case exits the Triage stage. How can I configure these separate trigger-based SLA conditions within Chronicle?
- using the "Get Case Communications" Siemplify Action Module be a viable workaround to detect updates and restart SLA timers dynamically? Has anyone successfully implemented something similar?