The Administrator can do Service Level Agreement (SLA) configuration. Only Administrator can view SLA Configuration page.
Navigation to SLA Configuration page
Go to Settings > SLA Configuration.
The list of types of incidents for which SLA is configured appears. You can expand the item in the list to view SLA.
The Incident Types are,
- Anomaly Detection
- APT
- Insider Threat
- Malware
- MITM
- Phishing
- Privilege Escalation
- Unknown
- Web Application Attack
- Default
Adding SLA
- ON the SLA Configuration page, click Add SLA for Incident Type. The Add SLA for Incident Type dialog appears.
- Select the incident type from the list. Only one SLA can be configured for each incident type. So, the list will show only the incident types for which SLA is not configured.
- Click Add.
Default SLA configuration appears. You can edit the SLA as required as the rule mentioned below. For the Severity, you can select the period of the respective status.
Rule for SLA
The values of the status should be incremental. The value of investigation must be less than the remediation value which should be less than the closed value. Example: If the Investigation value is 1, the remediation value should be greater than 1, so you can keep the value as 2. The closed value should be greater than 2, so you can keep the value as 3.
| INVESTIGATION | REMEDIATION | CLOSED |
| 1 | 2 | 3 |
As per the SLA configuration, the incident response summary is updated.
As per the set Investigation value, the incident changes status to Remediation after the value is attained. According to the values set for Remediation, the status ‘New’ ‘In time’, and ‘Late by’ appears in the Response Summary.
Note
If SLA is configured for all the Incident types and you click Add SLA for Incident Type, message prompt appears.
Editing SLA configuration
- On the SLA Configuration page, expand the SLA that you want to edit.
- Click the Edit icon. SLA configuration appears.
- Click the status value to edit it. You can select in Hours or Days. Select the value from the list. Ensure that other status values are as per the rule.
- Click Save.
Deleting SLA
- On the SLA Configuration page, expand the SLA that you want to delete.
- Click the Delete icon.
- Click Delete on the confirmation dialog box. The SLA is deleted.
Filter
To filter SLA as per your requirements, enter the criterion in the filter box, add more conditions as required. The displayed SLA list is automatically updated as per the set criteria.