> ## Documentation Index
> Fetch the complete documentation index at: https://docs.contraforce.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SLA Tracking

> Set response and resolution targets per workspace and severity, and track Time to First Response and MTTR on every incident.

SLA tracking measures how quickly your team responds to and resolves incidents against targets you set. Define the targets in an **SLA configuration**, assign it to workspaces, and the Incidents page tracks **Time to First Response** and **MTTR** for every incident in those workspaces.

<Info>
  **Who is this for?** Service providers and SOC managers who commit to response and resolution times with their customers.
</Info>

***

## Where SLAs Live

Select **Workspaces** in the left navigation, then the **SLA** tab in the Workspace Center. **SLA Configurations** lists each configuration with its time to first response, its time to resolution, and how many workspaces it applies to. Select the settings icon on a row to edit it.

***

## Creating an SLA Configuration

<Steps>
  <Step title="Add a Configuration">
    On the **SLA** tab, select **Add SLA configuration**.
  </Step>

  <Step title="Name It">
    Enter a **Name** and an optional **Description**.
  </Step>

  <Step title="Set the Targets">
    Enter the targets described below. Turn on **Advanced options** to set different targets for each severity (High, Medium, Low, Info). With it off, the same targets apply to every severity.
  </Step>

  <Step title="Assign Workspaces">
    Under **Workspaces**, search for and add the workspaces this configuration covers.
  </Step>

  <Step title="Save">
    Select **Save changes**.
  </Step>
</Steps>

<Warning>
  A configuration with no workspaces assigned has no effect. SLA tracking stays off for incidents in its scope until you assign at least one workspace.
</Warning>

***

## Targets

| Setting                              | What it means                                                                                                                               |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
| **Time to first response (minutes)** | How long the team has to respond after an incident arrives                                                                                  |
| **Time to resolution (minutes)**     | How long the team has to resolve the incident                                                                                               |
| **At-risk threshold (%)**            | The share of a target's time after which the incident is flagged as at risk. At 80, an incident is at risk once 80% of its time has elapsed |
| **Response definition**              | What counts as the first response                                                                                                           |
| **Resolution definition**            | What counts as resolution                                                                                                                   |

### Response Definition

| Option                                    | Counts as the first response                                                       |
| ----------------------------------------- | ---------------------------------------------------------------------------------- |
| **First assignment**                      | The first time the incident is assigned an owner                                   |
| **First status change away from New**     | The first time the status moves off **New**                                        |
| **Either, whichever first (recommended)** | Whichever of the two happens first                                                 |
| **Any CF principal action**               | Any action on the incident by a ContraForce principal, such as an analyst or agent |

### Resolution Definition

| Option                                      | Counts as resolution                                                  |
| ------------------------------------------- | --------------------------------------------------------------------- |
| **CF analyst sets to Closed (recommended)** | An analyst closes the incident in ContraForce                         |
| **Vendor reaches terminal Closed**          | The incident is closed in its source tool, such as Microsoft Sentinel |
| **Whichever comes first**                   | Whichever of the two happens first                                    |

<Tip>
  If your analysts sometimes close incidents directly in Microsoft Sentinel or Defender XDR, choose **Whichever comes first** so those closures still stop the resolution clock.
</Tip>

***

## Tracking SLAs on Incidents

For incidents in workspaces with an SLA configuration, the **Incidents** page shows **Time to First Response** and **MTTR** columns with a live countdown on each row. If the columns are hidden, turn them on with the column picker above the table.

***

## Related Guides

<CardGroup cols={2}>
  <Card title="Incident Management" icon="shield-halved" href="/guides/getting-started/incident-management">
    Triage, investigate, and close incidents
  </Card>

  <Card title="Workspace Manager" icon="folder-tree" href="/guides/getting-started/workspace-manager">
    Manage workspace settings
  </Card>

  <Card title="Incident Report" icon="file-chart-column" href="/guides/getting-started/incident-report">
    Review and print closures
  </Card>

  <Card title="Multi-Tenant Features" icon="building" href="/guides/getting-started/multi-tenant-features">
    Work across all your customers
  </Card>
</CardGroup>

***

<Note>
  Questions about SLA tracking? Contact us at [support@contraforce.com](mailto:support@contraforce.com).
</Note>