SLA Management in Logsign

1. Introduction to SLA Management in Logsign

SLA Management in Logsign allows security teams to define, monitor, and enforce time-bound rules for incident resolution. By tracking incident response times against pre-configured SLAs, Logsign ensures that your team meets the expected performance benchmarks.

An SLA policy applies to incidents that match its conditions (for example, incident category or risk score). Within each policy, First Reply Time and Total Resolution Time are set separately for each incident priority level: Low, Medium, High, and Urgent.

2. Accessing SLA Management

Steps:

1. Login to Logsign:

   • Open your browser and log in to your Logsign.

2. Navigate to SLA Management:

   • In the Settings, select Alerts & Incidents.
   • Navigate to the SLA section.

3. Creating a New SLA Policy

To establish an SLA, you must define rules that specify the time limits for responding to or resolving incidents based on certain criteria.

Steps to Create a New SLA:

1. Open SLA Settings:

   • Click on the SLA section and select + SLA. The Add SLA window opens.

2. Define SLA Conditions:

   • SLA Description: Provide a descriptive name for the SLA policy (e.g., "High-Priority Incident Resolution"). Only letters, numbers, spaces and the characters _ . - / are accepted.
   • Conditions: Choose the conditions that this SLA will apply to. Available fields are Incident.Category, Risk.Score, Action.Object, Incident.Tags, MitreList, Incident.OwnerName, Incident.Info and Incident.AlertCount. Organisation.Name is also available when the MSS license is active. At least one condition is required, and an incident must match all conditions of the policy.

3. Set SLA Timelines:

   • First Reply Time: Define the maximum time allowed for the initial response to the incident, separately for each priority (Low, Medium, High, Urgent). Each value is entered in hours and minutes.
   • Total Resolution Time: Set the deadline for fully resolving the incident, again in hours and minutes for each priority.

   • Save the SLA:

     • Once all the details have been filled in, click Save to apply the new SLA policy.

4. Monitoring SLA Compliance

After defining SLAs, Logsign automatically assigns an SLA to each incident and tracks its compliance with the SLA terms. If an incident matches none of your SLA policies, the default SLA is applied. The first reply and resolution deadlines are calculated from the incident's generation time and its priority, and incidents that miss a deadline are marked as late.

Steps to Monitor SLA Compliance:

1. View Incident Status:

   • Go to the Incidents page to view all incidents. Each incident displays its current SLA status. The SLA First Reply and SLA Resolution columns show the deadline of each incident.

2. SLA Progress Bars:

   • For each incident, Logsign shows two progress bars, Frt (First Reply Time) and Trt (Total Resolution Time). Each bar shows the time elapsed since the incident was generated, next to the SLA time limit. The bar turns green when the step is completed in time and red when the SLA is breached.

5. SLA Reports and Analytics

To maintain service standards and provide transparency in incident management, Logsign provides the SLA Monitoring dashboard in the dashboard library. Its SLA FRT and SLA TRT widgets list open incidents that have breached their first reply or total resolution time. The widget queries use GMT+3 for the time calculation, so you may need to adjust them to your server time.