SLA and remediation

Describes dashboard widgets for service level agreements and remediation

SLA settings are described at the end of this article.

See important notes for updating SLA settings in Update configuration settings in the Dashboard settings and system-wide defaults article.

SLA average

Displays: The percentage of security events that were handled within their SLA windows over time, providing an overall SLA compliance score.

Business Value: Key performance indicator for operational excellence and customer commitments.

Metrics Displayed:

  • Overall Average: Aggregate SLA compliance percentage

    Overall Average = Sum of all period averages ÷ Number of periods

    Example:

    CODE 
    Overall Average: 78.5% of events met SLA

  • Time Series: SLA compliance trending by period

  • Detailed timing metrics per period

How values are calculated

For Each Event:

The "due delta" measures how much time was available or exceeded:

CODE 
For Closed Events:
Due Delta = Due Time - Close Time
For Open Events:
Due Delta = Due Time - Current Time

SLA Compliance Percentage:

CODE 
SLA % = (SLA Window ÷ |Due Delta|) × 100

  • If value ≥ 100%: Event was handled within SLA (good)

  • If value < 100%: Event breached SLA (bad)

Example:

Event A (closed within SLA):

  • SLA window: 4 hours

  • Due time: 6:00 PM

  • Closed time: 5:30 PM

  • Due delta: 6:00 PM - 5:30 PM = 30 minutes early

  • SLA % = (240 minutes ÷ 30 minutes) × 100 = 800% ✓

Event B (breached SLA):

  • SLA window: 4 hours

  • Due time: 6:00 PM

  • Closed time: 7:00 PM

  • Due delta: 6:00 PM - 7:00 PM = -60 minutes (1 hour late)

  • SLA % = (240 minutes ÷ 60 minutes) × 100 = 400% (but negative, so this is a breach) ✗

Time Period: Selectable (hourly, daily, or monthly)

Filters Applied:

  • Date range

  • Optional user filter

  • Data source labels

  • Tenant (multi-tenant environments)

SLA breaches

Displays: Tracks how many security events missed their SLA deadlines, broken down by severity level over time.

Business Value: Monitors service level compliance and identifies patterns in SLA failures to improve response processes.

Metrics Displayed:

  • Time-series showing breach counts per time period

  • Separate lines for each severity level

  • Average breaches per time period

    Average = Total Breaches ÷ Number of Time Periods

Breaches are counted per time period and grouped by severity.

An event is counted as an SLA Breach if either of these conditions is true

  • Event was resolved after the due time

  • Event is still unresolved and current time is past the due time

Example

CODE 
Jan 1:
  - High severity: 8 breaches
  - Medium severity: 5 breaches
  - Low severity: 3 breaches
  - Total: 16 breaches

Jan 2:
  - High severity: 6 breaches
  - Medium severity: 4 breaches
  - Low severity: 2 breaches
  - Total: 12 breaches

Average: (16 + 12) ÷ 2 = 14 breaches per day

Time Period: Selectable (hourly, daily, or monthly)

Filters Applied:

  • Date range (based on due time)

  • Container labels

  • Tenant (multi-tenant environments)

SLA settings

These settings affect the SLA Breaches and SLA Average widgets.

Storage Location: System Settings database table

Configuration Path: Administration > Event Settings > SLA Settings

How SLAs are defined:

  • Format: JSON dictionary mapping severity names to time windows (in seconds)

  • Example:

    JSON 
    {
  "low": 604800,      # 7 days in seconds
  "medium": 86400,    # 24 hours in seconds
  "high": 14400,      # 4 hours in seconds
  "critical": 3600    # 1 hour in seconds
}

How SLA windows are used:

When a container (event) is created:

  1. System looks up the severity (for example, "high")

  2. Gets the corresponding SLA window (for example,14400 seconds)

  3. Sets due_time = create_time + SLA window

  4. Widgets track whether close_time ≤ due_time (met SLA) or close_time > due_time (breached)

Customization:

  • Each severity level can have a different SLA window

  • Values must be in seconds

  • SLA windows are validated to be positive integers