Start with onboarding
Reuse the group settings
Sub-tenants inherit a target unless a more specific setting applies.
MSSP/MDR · Process
Keep customer targets with the case.
Inherit defaults. Set exceptions.
Set response targets by priority and investigation phase in each customer’s SLA Matrix. Tenant settings can inherit from the customer hierarchy, while a rule-specific target takes precedence where configured; the applicable target follows the case’s priority and phase.
Targets by priority and phaseParent-to-customer inheritanceRule-specific overrides take precedence
Tenant ArchitectureNorthstar
SLA Matrix
Critical / Triage1 hNo customer overrideGlobal default
High / Investigation8 hNo customer overrideGlobal default
Medium / Containment12 hNo customer overrideGlobal default
Northstar
- Priority
- High
- Triage
- 2 h
- Investigation
- 8 h
- Containment
- 8 h
- Eradication
- 12 h
- Recovery
- 24 h
Illustrative High-priority cells. Global default applies to these hours.
Tenant ArchitectureNorthstar
SLA MatrixNorthstar
Critical / Triage0.5 hNorthstar settingOverride
High / Investigation4 hNorthstar settingOverride
Tenant ArchitectureHarbor Retail
SLA MatrixHarbor Retail
Critical / Triage0.5 hFrom Harbor GroupInherited
High / Investigation4 hFrom Harbor GroupInherited
CasebookNorthstar
NS-104
- Priority
- Critical
- Phase
- Investigation
- Target
- 1 h
- Source
- Rule-specific target
This rule sets the investigation target for the case’s current priority.
Response targets
Rule-specific targetConfigured: 1 h
AppliesTenant overrideNorthstar: 2 h
Global defaultInvestigation / Critical: 4 h
Use the most specific applicable target.
CasebookNorthstar
NS-104
- Priority
- High
- Phase
- Investigation
- Target
- 4 h
- Source
- Northstar override
Northstar supplies the target for High-priority investigation work.
Response targets
Rule-specific targetNone for High / Investigation
Tenant overrideNorthstar: 4 h
AppliesGlobal defaultInvestigation / High: 8 h
The priority changed. The applicable phase target recalculates.
A rule-specific target takes precedence over the tenant override and the global default.
Northstar’s matrix uses global defaults until a tenant or rule provides a more specific target. All hours shown are illustrative.
A Northstar override changes Critical triage. A separate Harbor Retail example inherits its setting from Harbor Group.
On NS-104 a rule-specific target takes precedence over the tenant override and global default.
When the case priority changes to High, the applicable investigation target recalculates. In this example there is no rule override for that combination.
Illustrative customer workflow
01 - What it does
Put the service target where analysts work.
An agreed target needs a place in the daily case workflow. The SLA Matrix expresses it by priority and phase, and shows whether a customer’s value is an override, inherited or a global default.
Make exceptions explicit.
Start with defaults for the customer hierarchy, then change the cells that need a tenant-specific target. A child tenant can inherit from its nearest ancestor with a setting. When a rule specifies a target, that value takes precedence. Your analysts can work from the applicable case target instead of choosing between a general service setting and a customer exception during an investigation. A priority change recalculates the applicable target for the current phase.
The targets you agree with each customer travel with the case.
Northstar: NS-104 targetExample
- Priority
- High
- Phase
- Investigation
- Target
- 4 h
- Source
- Northstar override
Illustrative setup and values, not customer results.
Keep pace with the case
The applicable target follows changes to priority and phase.
02 - How it works in the product
Set a matrix. Check the effective target.
Use the customer hierarchy to carry common settings and the matrix to express exceptions. Verify the target that applies to a sample case, including any rule-specific value, before using the setup for customer work.
- 01Tenant Architecture
Select the customer whose service settings you want to review.
- 02SLA Matrix
Set hours for the required priority and phase, or keep inherited values.
- 03SLA Matrix
Review Override, Inherited and Global default labels to identify the source.
- 04Casebook
Check the applicable target after the case’s priority or phase changes.
These are service targets, not a guarantee of response time.
03 - How it connects
Let the case determine the target.
Casebook carries the investigation’s priority and phase. Multi-tenant management supplies the hierarchy and customer overrides, so the service target follows both the customer and the current work.
Works with
In the editions
The PortalDefault module
Multi-Tenant is a default module of this edition.
Autonomous SOCOutside the defaults
Discuss licensing for provider operations.
SecOps PlatformIncluded
Multi-tenant operations belong to this tier.
04 - What it means for your service
Give the team a target it can explain.
A visible source makes a customer exception easier to review. The provider can keep common targets in the hierarchy and track the case against the effective setting without presenting that setting as a response-time promise.
Less manual lookup
The applicable target is resolved from the configured settings.
Traceable exceptions
Override and inheritance labels explain where a matrix value comes from.
Customer-specific service settings
Keep a customer’s target aligned with its priority and phase configuration.
Start with one customer
- 01Select a customer
Review its parent settings in Tenant Architecture.
- 02Set one exception
Change a priority and phase cell that needs a customer override.
- 03Check a sample case
Confirm precedence and target recalculation before extending the setup.
Questions about SLA targets per customer.
1Can each customer have its own case response targets?
Yes. You can configure case time budgets by priority and lifecycle phase, with customer overrides and inheritance from a parent tenant. A rule-specific target takes precedence; otherwise the tenant setting or global default applies. These are workflow targets for tracking your service, not a promise of response times from Imperum.
2What wins when a rule and a tenant specify different targets?
A rule-specific target takes precedence. Otherwise the tenant override applies, including an inherited value from the nearest ancestor with a setting; the global default is the fallback.
Have any other questions? Talk to our team
Set the customer’s target.
Keep it with the case.
Review your customer hierarchy and response-target setup with the Imperum team.