Skip to main content
SLA tracking measures how quickly your team responds to and resolves incidents against targets you set. Define the targets in an SLA configuration, assign it to workspaces, and the Incidents page tracks Time to First Response and Time to Resolution for every incident in those workspaces.
Who is this for? Service providers and SOC managers who commit to response and resolution times with their customers.

​
Where SLAs Live

Select Workspaces in the left navigation, then the SLA tab in the Workspace Center. SLA Configurations lists each configuration with its time to first response, its time to resolution, and how many workspaces it applies to. Select the settings icon on a row to edit it.

​
Creating an SLA Configuration

1

Add a Configuration

On the SLA tab, select Add SLA configuration.
2

Name It

Enter a Name and an optional Description.
3

Set the Targets

Enter the targets described below. Turn on Advanced options to set different targets for each severity (High, Medium, Low, Info). With it off, the same targets apply to every severity.
4

Assign Workspaces

Under Workspaces, search for and add the workspaces this configuration covers.
5

Save

Select Save changes.
A configuration with no workspaces assigned has no effect. SLA tracking stays off for incidents in its scope until you assign at least one workspace.

​
Targets

​
Response Definition

​
Resolution Definition

If your analysts sometimes close incidents directly in Microsoft Sentinel or Defender XDR, choose Whichever comes first so those closures still stop the resolution clock.

​
Tracking SLAs on Incidents

For incidents in workspaces with an SLA configuration, the Incidents page shows Time to First Response and Time to Resolution columns with a live countdown on each row. If the columns are hidden, turn them on with the column picker above the table.

​
How the Clocks Run

Both clocks start when the incident is detected. Time to first response stops at the first response, and Time to resolution stops when the incident is resolved. Setting an incident to On Hold or Waiting on Customer pauses whichever clocks are still running, and setting it back to another status resumes them. Paused time doesn’t count toward either target, and each clock excludes only the paused time that fell while it was running.

​
SLA Tab

Open an incident and select the SLA tab to see the targets it’s measured against and a timeline of what moved its clocks: detection, the first response, each pause and resume with the status that caused it, any at-risk or breached crossings, and the resolution.

Incident Management

Triage, investigate, and close incidents

Workspace Center

Manage workspace settings

Incident Report

Review and print closures

Multi-Tenant Features

Work across all your customers
Questions about SLA tracking? Contact us at support@contraforce.com.
Last modified on October 23, 2026