I am trying to setup SLAs for Security Incidents based on Severity but i am getting multiple SLAs applied

[kyles]

I have created two SLAs setup for Low and Medium Severity. I have an inbound email action to manually set the Severity to 3-Low if the Subject has Low and an email action to set the Medium email subject Severity to 2-Medium. The Security incident that is created from the Medium email has the Severity set to 2-Medium and only the Medium SLA is applied. However when the Security Incident is created for the Low email, the Severity is set to 3-Low but both Medium and Low SLA are applied.If I change the SLA start condition to look at the Subject the correct SLAs are applied; Low only gets the Low SLA and Medium only gets the Medium SLA. I have tried to disable all the Security Incident Calculators Group > Severity and also disabled the Calculate Severity Business rule. Where else would the Severity be manipulated to cause both Low and Medium SLAs to be applied to the Low Security Incident?

[kyles]

I am using inbound email actions which i created. We receive the emails from our DLP solution and the email Subject has the Severity listed (Low, Medium, or High). I have created a separate rule for each Subject condition. I haven't considered combining them into a script as I felt having single rules made it less complicated. The Execution order has the High set to 18, Medium to 19, and Low to 20. Stop processing is checked on each rule.

I have attached screenshots of the SLA Def Conditions for Ashutosh.

Thank you both for trying to help me out here.

[Balaji Jagannat]

Can you also provide the screenshot on how you are setting the Severity (if you can)?

[Ashutosh Munot1]

HI,

Can you change the condition from Severity to priority and test this.

I did that and it worked

Thanks,
Ashutosh

[kyles]

Here is the inbound email action where i set the Severity (Low is setup the same except the Severity is 3-Low)

I would like to get the Severity to work as we have other Events coming into ServiceNow from our SIEM and they are all configured to set the Severity so we can assign SLAs to them correctly. I have set the SLA to be applied if I have a specific Subject in the email (Short Description is updated with Subject) but then I would have to create many SLA definitions for each email Subject or Short Description.

[Balaji Jagannat · Accepted solution]

Kyles - can you try this?

Set all your field value in the script block itself (specifically the Severity field value setting) before the current.insert() code line. (I suspect, the field action takes place after the script execution).  

Let me know whether it helps.