Added new SLA OOB content:

[idovandijk]

Main Changes

• Upgraded phishing layout (summary + quickview)
• Added 3 new fields: Detection SLA, Remediation SLA and Time to Assignment
• Added a new SLA dashboard with new widgets
• Upgraded Phishing Investigation - Generic playbook - now utilizes new SLA features
• Added 3 new scripts:

1. A script to change remediation SLA automatically, upon change of severity of incident
2. A script that sends an Email of SLA breach, which can be set to run upon SLA breach
3. A script to change the Time to Assignment field (new field) upon owner change (from empty owner to some new owner)

• Added 5 new widgets of many different types, which will be presented in new SLA dashboard:

1. Detection SLA by Status (pie)
2. Remediation SLA by Status (pie)
3. MTTD by Type (timeline)
4. MTTR by Type (timeline)
5. Mean Time to Detection (counter)
6. Mean Time to Resolution (counter)

Related Issues

fixes: https://github.com/demisto/etc/issues/14090

Description

Added new OOB SLA features

Screenshots

Required version of Demisto

3.5 only for MTTR by Type widget (MTTR already existed)
4.1.0 for everything else

Does it break backward compatibility?

• No

Additional changes

After discussing some of the requirements we have reached conclusions:

• Time to Assignment is not presented in phishing layout by default
• 3 Scripts were created, though not necessarily the scripts that were discussed in the beginning
• Scripts can, but will not be triggered automatically upon field changes / breaches. Customers will have to choose the script that will run on field change (scripts are tagged to make it easier to find)
• Widgets are a bit different than those discussed in the beginning. Additional widgets were added on top of the ones discussed in the beginning

[Itay4]

best practise is to use fromversion: 4.1.0

[glicht]

@idovandijk I am ok with the description fixes.

I have an issue with the incident types. I did a load of the content released from circleci and i am not seeing the new incident types.

Can you test this out.

[idovandijk]

I tested on both 4.0 and 4.1 successfully. No bugs so far.
4.0 shows no 4.1 content. Failing tests are not mine. Playbook runs well on 4.1 and so do the rest of the features.

Injecting to trigger timetoassignment script:

Injecting to trigger remediationsla script:

Dashboards (now stretched out as requested):

Layouts:

I think we can merge now :)

[ronykoz]

@idovandijk why there are so many changes in the id_set.json file?

[idovandijk]

@idovandijk why there are so many changes in the id_set.json file?

It's only what we changed together. Maybe the order of the fields? Remember they kept changing order on my pc

[ronykoz]

@idovandijk why there are so many changes in the id_set.json file?

It's only what we changed together. Maybe the order of the fields? Remember they kept changing order on my pc

seems that you are not pulled from master, could you try to pull from master and see what happens?

[idovandijk]

@ronykoz can you approve this PR so Anar will merge?