Creating Tickets from Recommended Actions

Create tickets in a third-party ticketing system from your recommended actions, so that they will automatically be included in the relevant Remediation Owner's workflow.

Prerequisites

Required Permissions

• Recommended Actions → View
• Enforcements → Run
• Enforcements → Add

Admin users have all 3 permissions by default.

In addition, ensure you have the permissions required for the Enforcement Action you're using to create tickets.

Adapters

To create tickets, you must connect either of the following adapters: Jira Service Management or Atlassian (Formerly Atlassian Jira Software).

Initial Setup

To create a ticket for a recommended action, click Create Ticket directly from the Action Drawer.

The first screen displayed in the Create Ticket drawer shows previews for each ticket type that will be created. Each remediation owner is assigned their own ticket, and there can be more than one.

• If the ticket type includes Security Findings that don't have remediation owners, they are marked as Missing ownership data.
• Each ticket type shows the number of Security Findings that will be included in it.
• Some ticket types are marked with a Destination required tag. This means that tickets created for these Security Findings don't have a ticketing system (destination endpoint) defined. This happens when the Security Findings associated with this ticket:

  • Don't have a remediation owner defined for them. In this case, they are also marked as Missing ownership data.

    OR

  • Have a remediation owner defined without a destination endpoint. This happens when the destination defined for this owner is an email instead of ticketing system, OR when the ticketing system defined is ServiceNow instead of Jira. For more information on ownership destinations, refer to step 5 in Creating an Ownership.

Security Findings without ownership data and destination are skipped in the ticket creation process by default. To change that, you need to manually include them by customizing the ticket distribution setting.

1. Click Customize at the bottom of the screen. The Distribution section of the Create Ticket wizard opens.
2. Under Distribution Summary, select for each group of Security Findings whether to skip or include it in the ticket creation process.

The ticket count displayed at the top of the drawer updates according to your selection to include or skip groups.

In the following example, the group of Security Findings that are Missing Ownership data is skipped and only the IT team group is included, so the ticket count is 1:

Upon clicking Include this group for Missing Ownership data, the ticket count updates to 2:

The ticket count continues to update according to the next settings:

1. Distribution - Control how many tickets are created and how they are split
2. Configuration - Define ticket details

Grouping Tickets

While the initial setup determines the remediation ownerships to which each ticket is sent, additional grouping settings control the distribution and final number of tickets. Grouping is set by selecting an asset type + field to split tickets by. For tickets created from recommended actions, by default, all tickets are grouped by Security Findings asset type and the Remediation Owner field. That is the first grouping level and it is not editable. It is the first row that appears under Distribution fields:

Add one or more distributions field to split Security Findings into separate tickets based on field values.

1. Click + Add another field.
2. Select the field to group by. Upon selection, The first row reads: "Group tickets by [Security Findings] [Remediation Owner]", and each subsequent row reads: "and then by [Security Findings] [field name]".

To remove a grouping level, select × on that row.

Axonius adds a new row to the distribution field list and updates the ticket count in the Distribution Summary bar. Expand the rows to review the full ticket distribution and count.

Click Next to proceed to the Configuration stage - defining ticket details.

Ticket Configuration

In this section, configure ticket details for each remediation owner. Navigate between them from the Owners left sidebar.

For full configuration instructions, see the following sections in the Creating a Ticket general documentation:

Ticketing System

Content Details

Additional Fields

Testing a Ticket

When you're done with all configurations, click Create N Tickets (or Back if you want to edit previous settings).

Managing Tickets

To view, track and manage the tickets created from Recommended Actions, navigate to the Tickets page.