SLA
How many days a finding of each severity may take to be verified, assigned and resolved, and how a missed deadline shows.
An SLA sets how many days a finding may stay in each triage step. When a finding takes longer, it is SLA violated. There are three deadlines for each severity:
| Deadline | Counts from | Ends when the finding is |
|---|---|---|
| Days to verify | the day the finding was created | verified or rejected |
| Days to assign | the day it was verified | assigned |
| Days to resolve | the day it was assigned | resolved or its risk is accepted |
The first is for the security team, the other two for the product teams.
Findings become Assigned only through a task tracker whose assignees move findings to Assigned. While Assignment SLA is on (the default), a verified finding in a product without such a tracker has no deadline at all: it is never assigned, so neither the deadline to assign nor the one to resolve starts.
Set the deadlines
Open the settings, then SLA Config under Metrics Configuration, and enter the days for each severity and step.
Turn off Assignment SLA unless your teams assign findings in a task tracker. The deadline to assign is then not counted, and the deadline to resolve counts from verification. Findings still move to Assigned.
The Auto Validator verifies findings as they arrive, which keeps the security team inside its deadline to verify.
Where it shows
- SLA days remaining on each finding: the days left before the current deadline.
- SLA violated on each product card: how many of its findings missed a deadline.
- The SLA filter in Findings, to list the findings that missed their deadline.
- The SLA charts on the dashboard and in reports.
A task tracker integration can set the due date of each task from these deadlines.