Policy
In Settings › Organizations, SLA targets sets, per severity, the target time to respond and the target time to resolve. The organization's Settings set the coverage: 24x7, or business hours in the organization's time zone, and the point at which a warning fires. Outside business hours the clock does not run.
Measurement
The times an alert was created, first triaged and closed are written once and never edited. Time to respond and time to resolve are computed from them, within the coverage window. The alert queue shows the remaining time per alert. A warning notification fires as the target approaches, and another when it is missed.
Reporting
The customer portal's Reports page shows, per severity and month, the number of alerts, the share met, breached and pending, and the average times to respond and resolve. A monthly report is also generated and delivered to the portal.
Exclusions
Suppressed matches never enter the queue and never start a clock. Every alert that reaches the queue counts.