---
updatedAt: 2026-01-25T15:56:43.000Z
agentTools:
  projectIndex: https://docs.axonius.com/llms.txt
---

# ChangeGear - Create Incident

**ChangeGear - Create Incident** creates a single incident in ChangeGear listing all the affected assets retrieved from the saved query or assets selected on the relevant asset page.

See [Creating Enforcement Sets](/docs/create-ec-set) to learn more about adding Enforcement Actions to Enforcement Sets.

<Accordion title="When accessing an enforcement action using the API, you must use the backend form of field names. " icon="fa-info-circle">
  Use the [Syntax Helper](/docs/using-the-syntax-helper) to find the correct name. In the enforcement action, enable **Configure Dynamic Values** and select **Syntax Helper**.


  <Image src="https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/img/action_center/SyntaxHelperForAPIECs.png" width="550px" />

</Accordion>

<Callout icon="📘" theme="info">
  ### Note

  - Not all asset types are supported for all Enforcement Actions.
  - See Actions supported for [Activity Logs, Adapters Fetch History, and Asset Investigation modules](/docs/creating-queries-filters#using-activity-log-adapter-fetch-history-asset-investigation-and-findings-queries-in-enforcement-actions).
  - See Actions supported for [Aggregated Security Findings](https://docs.axonius.com/docs/vulnerabilities#using-aggregated-security-findings-queries-in-enforcement-actions).
  - See Actions supported for [Software](software#using-software-queries-in-enforcement-actions).
</Callout>

## Required Fields

These fields are necessary to run the Enforcement Action.

* **Action name** - The name of this Enforcement Action. The system sets a default name. You can change the name.
* **Configure Dynamic Values** *(optional)* - Toggle on to enter a Dynamic Value statement. See [Creating Enforcement Action Dynamic Value Statements](https://docs.axonius.com/docs/config-ec-conditions) to learn more about Dynamic Value statement syntax.

- **Split Tickets By** - When enabled, group assets into different tickets based on a shared attribute. Click the adapter icon to select an adapter (or Aggregated), and then click the **Select Adapter Field** box to select the asset field used to generate a separate ticket for each unique value.

  <Callout icon="📘" theme="info">
    ### Note

    - The **Split Tickets By** option appears only in ticket creation actions, and does not appear in ticket-per-asset creation or ticket update actions.
    - For assets containing multiple values, the system uses only the first value to perform the split.
  </Callout>

<br />

* **Use stored credentials from the ChangeGear adapter** - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

<Callout icon="📘" theme="info">
  NOTE

  * To use this option, you must successfully configure a [ChangeGear](/docs/changegear) adapter connection.

  * The API key used for the adapter connection must be user with permissions to create new asset.
</Callout>

* **Summary** - Add a summary to the incident.
* **Impact** - Select the impact level from the list.
* **Urgency** - Select the urgency level from the list.
* **Priority** - Select the priority level from the list.
* **Due in x Days** - The incident must be handled within the indicated number of days.
* **Compute Node**  - The Axonius node to use when connecting to the specified host. For more details, see [Working with Axonius Compute Nodes](https://docs.axonius.com/docs/connecting-additional-axonius-nodes).

## Additional Fields

These fields are optional.

* **Incident Type ID** - The ID of the incident type.
* **Incident Type** - Select the incident type from the list. If **Incident Type ID** is used, this value is ignored.

<Callout icon="💡" theme="warn">
  ## Connection and Credentials

When **Use stored credentials from the adapter** is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.

  * **Host Name or IP Address** - The hostname or IP address of the ChangeGear server.

  * **User name** and **Password** - To connect to ChangeGear you will need to create a user with action privileges.

  * **Verify SS&#x4C;_&#x20;(Optional)_**_&#x20;(default: enabled)&#x20;_- Selects whether to verify the SSL certificate of the server against the CA database inside of Axonius.  For more details, see [SSL Trust & CA Settings](/docs/certificate-settings#ssl-trust-ca-settings). This setting is enabled by default on all new adapter settings. If you need to disable SSL verification, make sure you disable this setting._)_&#x20;

  * **HTTPS Proxy** *(optional)* - Connect the adapter to a proxy instead of directly connecting it to the domain.

  * **HTTPS Proxy User Name** _(optional)_ - The user name to use when connecting to the server using the  **HTTPS Proxy**.

  * **HTTPS Proxy Password** *(optional)* - The password to use when connecting to the server using the **HTTPS Proxy**.
</Callout>

***

For more details about other enforcement actions available, see [Action Library](/docs/action-library).