topic Custom SLA timer field for case in Cortex XSIAM Discussions

Custom SLA timer field for case

Pierre.Dufresne — Wed, 14 Oct 2026 19:31:17 GMT

Dear community,

I have a question regarding SLA custom fields.

We have created a custom case timer field along with its associated SLA custom field to measure Time to Detection. The SLA targets are defined based on the case severity: 15 minutes for Critical, 30 minutes for High, 2 hours for Medium, and 12 hours for Low.

We have encountered situations where a case is initially created with a Low severity, but when a new High-severity issue is added to the case, the case severity is automatically updated to High. When this occurs, the SLA immediately becomes significantly overdue, which skews our SLA statistics.

Is there a recommended way to handle this scenario?

Thanks.

Re: Custom SLA timer field for case

ZachIvins — Fri, 16 Oct 2026 23:46:57 GMT

One solution would be switching to issue SLAs instead of cases. You can set clocks at the issue level, and have dashboards tracking the issue SLA clocks based on the issue's severity. You just want to ensure your dashboard is either specifically looking at MTTR, or you're filtering out issues where the CaseID is null because not all low issues generate cases and therefor won't be closed.

Re: Custom SLA timer field for case

ZachIvins — Fri, 16 Oct 2026 23:52:50 GMT

Forgot to mention, you'd need to ensure you're checking the "close issues" when closing cases, and likely want a fallback job that runs to query all issues with CaseIDs where the case is resolved and close them. That would cover any gaps in processes.