REST Resource: projects.locations.instances.slaDefinitions

Resource: SlaDefinition

This service is available for customers who migrated SOAR to a customer managed project and have the Chronicle API enabled. A Service Level Agreement (SLA) represents a commitment by the SOC to perform specific tasks, such as investigation or remediation of specific cases within a specified duration of time.

JSON representation 
{
  "name": string,
  "slaType": enum (SlaType),
  "alertType": enum (AlertType),
  "slaTypeValue": string,
  "slaPeriod": number,
  "slaPeriodTimeUnit": enum (SlaTimeUnit),
  "criticalSlaPeriod": number,
  "criticalSlaPeriodTimeUnit": enum (SlaTimeUnit),
  "environments": [
    string
  ]
}
Fields
name

string

Identifier. The unique name(ID) of the SlaDefinition. Format: projects/{project}/locations/{location}/instances/{instance}/slaDefinitions/{slaDefinition}
slaType

enum (SlaType)

Required. Immutable. The SLA type. Cannot be updated after creation.
alertType

enum (AlertType)

Optional. When ALERT_RULE_GENERATOR is chosen, specify which type of alert to set SLA.
slaTypeValue

string

Required. Can be a specific alert-rule-generator in case SLA_TYPE = ALERT_RULE_GENERATOR, or CASE_STAGE = TRIAGE
slaPeriod

number

Required. Amount of time in seconds from SLA starts until SLA time expires.
slaPeriodTimeUnit

enum (SlaTimeUnit)

Required. Specify time unit for the SLA period (minutes, hours, etc.).
criticalSlaPeriod

number

Required. The time period of the SLA until it becomes critical.
criticalSlaPeriodTimeUnit

enum (SlaTimeUnit)

Required. The unit of critical sla period (minutes, hours, etc.).
environments[]

string

Required. User logical environments.

SlaType

The type of SLA to configure.

Enums
SLA_TYPE_UNSPECIFIED Unspecified SLA type.
ALERT_RULE_GENERATOR Either all alerts or specific ones.
CASE_STAGE Case stage, defined in Case proto. e.g. TRIAGE, INVESTIGATION. or ASSESSMENT.
CASE_PRIORITY Case priority, defined in Case proto. Can be one of the following options: INFORMATIVE, LOW, MEDIUM, HIGH, or CRITICAL.
ALERT_PRIORITY Alert priority, defined in Alert proto. Can be one of the following options: INFORMATIVE, LOW, MEDIUM, HIGH, or CRITICAL.

AlertType

The alert types.

Enums
ALERT_TYPE_UNSPECIFIED Unspecified alert type.
ALL_ALERTS Either all alerts or specific ones.
SPECIFIED_ALERTS E.g. triage, investigation.

SlaTimeUnit

The unit of time for the SLA period.

Enums
SLA_TIME_UNIT_UNSPECIFIED Unspecified time unit.
MINUTES Time unit in minutes.
HOURS Time unit in hours.
DAYS Time unit in days.

Methods

create

 Creates a SlaDefinition.

delete

 Deletes a SlaDefinition.

export

 Exports a SlaDefinitions.

get

 Gets a SlaDefinition.

import

 Imports a SlaDefinitions.

list

 Lists a SlaDefinitions.

patch

 Updates a SlaDefinition.