Cherwell - Update Tickets
Cherwell - Update Tickets updates existing Cherwell IT Service Management incident tickets that are related to:
- Assets matching the Enforcement Set query or assets selected on the relevant asset page. For example, if the action is triggered on asset type=Users, the action updates tickets linked to each user.
- When triggered on any asset type except Tickets (for example, Users, Devices), this action updates related ServiceNow tickets based on your selection in the Select Which Related Tickets To Update dropdown (see below).
- When triggered on asset type=Tickets, this action runs on all tickets resulting from the selected query. The Select Which Related Tickets To Update dropdown is not applicable in this scenario.
The action updates the Cherwell incident fields Status, OwnedBy, and Comments. It can also update valid additional fields supplied as JSON. Each ticket must provide its Cherwell ticket ID (busObRecId).
See Creating Enforcement Sets to learn more about adding Enforcement Actions to Enforcement Sets.
When accessing an enforcement action using the API, you must use the backend form of field names.
Use the Syntax Helper to find the correct name. In the enforcement action, enable Configure Dynamic Values and select Syntax Helper.

Note
- Not all asset types are supported for all Enforcement Actions.
- See Actions supported for Activity Logs, Adapters Fetch History, and Asset Investigation modules.
- See Actions supported for Aggregated Security Findings.
- See Actions supported for Software.
Required Fields
These fields must be configured to run the Enforcement Action.
- Action name - The name of this Enforcement Action. The system sets a default name. You can change the name.
- Configure Dynamic Values (optional) - Toggle on to enter a Dynamic Value statement. See Creating Enforcement Action Dynamic Value Statements to learn more about Dynamic Value statement syntax.
-
Use stored credentials from the Cherwell IT Service Management adapter - Select this option to use credentials from the adapter connection. By default, the first connection is selected.
- When you select this option, the Select Adapter Connection drop-down is available, and you can choose which adapter connection to use for this Enforcement Action.
When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.
NoteTo use this option, you must successfully configure a Cherwell IT Service Management adapter connection.
-
Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.
Ticket Main Settings
These fields are optional.
-
Ticket Status - The status to set for the Cherwell incident. Enter a free-form text value that matches a valid status in your Cherwell instance (for example,
New,In Progress,Resolved). Status values are instance-specific. -
Ticket Assignee - The Cherwell user assigned to own the incident (maps to the OwnedBy field).
-
Ticket Comments - Free-form text to add as a comment in the Cherwell incident.
- Select Which Related Tickets To Update - Relevant when this enforcement action runs on an asset category other than Tickets. Select which tickets to update.
Ticket Additional Settings
These fields are optional.
-
Map Axonius fields to adapter fields - Use the Field Mapping Wizard to map Axonius fields to fields in external systems. In this way, you can transfer data found in Axonius into the external system as part of the configuration of relevant enforcement actions. The wizard shows you which fields exist on the Axonius system, allowing you to map them easily.
Note:
For details, see Axonius to External Field Mapping.
Additional Fields
These fields are optional.
Additional fields - Specify additional fields to be added as key/value pairs in a JSON format.
For example:
{"field1": "value1", "field2": "value2"}If one of the specified fields is invalid, the request might fail.
Connection and CredentialsWhen Use stored credentials from the adapter is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.
Cherwell Domain - The hostname or IP address of the Cherwell server (for example,
cherwell.company.com).User Name and Password - The credentials of a Cherwell user with permissions to update incidents.
Client ID - The client ID created in the CSM Administrator. For details, see Obtaining API Client IDs.
Verify SSL (Optional) (default: enabled) - Selects whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings. This setting is enabled by default on all new adapter settings. If you need to disable SSL verification, make sure you disable this setting.)
HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.
HTTPS Proxy User Name (optional) - The user name to use when connecting to the server using the HTTPS Proxy.
HTTPS Proxy Password (optional) - The password to use when connecting to the server using the HTTPS Proxy.
Gateway Name - Select the Gateway through which to connect to perform the action.
APIs
Axonius uses the Cherwell REST API - POST api/V1/savebusinessobject
Axonius also calls the following supporting endpoints:
- POST
token- To obtain an OAuth 2.0 access token using the password grant type. - POST
api/V1/GetBusinessObjectTemplate- To retrieve the incident field template used to map field names and IDs before saving.
Required Ports
Axonius must be able to communicate via the following ports:
- TCP port 80/443
Required Permissions
The stored credentials, or those provided in Connection and Credentials, must have the following permission(s) to perform this Enforcement Action:
- A Cherwell user account with permissions to update incidents (write access to the Incident business object).
- The account must be able to authenticate via the Cherwell REST API using the password grant type (username, password, and a valid Client ID).
- The Client ID must be created and enabled in the CSM Administrator under REST API settings.
For more details about other enforcement actions available, see Action Library.
Updated 1 day ago
