SLA Dynamic Configuration & Alerting

Question

Hi team,

I am wanting to configure the following SLAs in SecOps to do the following:

A separate SLA for a case being unassigned
A new SLA countdown once the case has been assigned depending on severity
A third for when either an action is awaiting approval from second line support e.g the case in an escalation state (between first and second line)

Also, has anyone had success in integrating SecOps SLA notifications into 3rd party tools (Slack, ServiceNow, Jira,etc)?

Thanks

Eoved · Answer

Hi,You can configure SLA settings under SOAR Settings > Environments > SLA.There are several SLA types available (Alert, Case, Priority, etc.), and you can define multiple conditions.For your first and second requirements, I think you can use two SLA definitions based on Alert and Stage.For the third requirement, I think you can try using the Pause option.In addition, I believe you can achieve a similar result through playbooks by using the Simplify integration and the actions it provides:Please review the following link:https://docs.cloud.google.com/chronicle/docs/soar/admin-tasks/configuration/setting-the-slaHope this helps!

Sign up

Login with SSO

Login to the community

Login with SSO