---
updatedAt: 2026-09-17T17:15:33.000Z
agentTools:
  projectIndex: https://docs.axonius.com/llms.txt
---

# Cherwell - Update Incident

**Cherwell - Update Incident** updates existing Cherwell IT Service Management incidents that are related to:

* Assets matching the Enforcement Set query or assets selected on the relevant asset page. For example, if the action is triggered on asset type=Users, the action updates tickets linked to each user.
  * When triggered on any asset type except Tickets (for example, Users, Devices), this action updates related tickets based on your selection in the **Select Which Related Tickets To Update** dropdown (see below).
  * When triggered on asset type=Tickets, this action runs on all tickets resulting from the selected query. The **Select Which Related Tickets To Update** dropdown is not applicable in this scenario.

The action updates the Cherwell incident fields **Status**, **OwnedBy**, and **Comments**. It can also update valid additional fields supplied as JSON. Each ticket must provide its Cherwell ticket ID (`busObRecId`).

See [Creating Enforcement Sets](/docs/create-ec-set) to learn more about adding Enforcement Actions to Enforcement Sets.

<Accordion title="When accessing an enforcement action using the API, you must use the backend form of field names. " icon="fa-info-circle">
  Use the [Syntax Helper](/docs/using-the-syntax-helper) to find the correct name. In the enforcement action, enable **Configure Dynamic Values** and select **Syntax Helper**.


  <Image src="https://raw.githubusercontent.com/Axonius/ax-docs-pub/refs/heads/main/img/action_center/SyntaxHelperForAPIECs.png" width="550px" />

</Accordion>

<Callout icon="📘" theme="info">
  ### Note

  - Not all asset types are supported for all Enforcement Actions.
  - See Actions supported for [Activity Logs, Adapters Fetch History, and Asset Investigation modules](/docs/creating-queries-filters#using-activity-log-adapter-fetch-history-asset-investigation-and-findings-queries-in-enforcement-actions).
  - See Actions supported for [Aggregated Security Findings](https://docs.axonius.com/docs/vulnerabilities#using-aggregated-security-findings-queries-in-enforcement-actions).
  - See Actions supported for [Software](software#using-software-queries-in-enforcement-actions).
</Callout>

## Required Fields

These fields must be configured to run the Enforcement Action.

* **Action name** - The name of this Enforcement Action. The system sets a default name. You can change the name.
* **Configure Dynamic Values** *(optional)* - Toggle on to enter a Dynamic Value statement. See [Creating Enforcement Action Dynamic Value Statements](https://docs.axonius.com/docs/config-ec-conditions) to learn more about Dynamic Value statement syntax.

- **Use stored credentials from the Cherwell IT Service Management adapter** - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

  * When you select this option, the **Select Adapter Connection** drop-down is available, and you can choose which adapter connection to use for this Enforcement Action.

  When you select this option, the **Select Adapter Connection** drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

  <Callout icon="📘" theme="info">
    ### Note

    To use this option, you must successfully configure a [Cherwell IT Service Management](/docs/cherwell) adapter connection.
  </Callout>

- **Compute Node**  - The Axonius node to use when connecting to the specified host. For more details, see [Working with Axonius Compute Nodes](https://docs.axonius.com/docs/connecting-additional-axonius-nodes).

## Ticket Main Settings

These fields are optional.

* **Ticket Status** - The status to set for the Cherwell incident. Enter a free-form text value that matches a valid status in your Cherwell instance (for example, `New`, `In Progress`, `Resolved`). Status values are instance-specific.

* **Ticket Assignee** - The Cherwell user assigned to own the incident (maps to the **OwnedBy** field).

* **Ticket Comments** - Free-form text to add as a comment in the Cherwell incident.

- **Select Which Related Tickets To Update** - Relevant when this enforcement action runs on an asset category other than Tickets. Select which tickets to update.

## Ticket Additional Settings

These fields are optional.

* **Map Axonius fields to adapter fields** - Use the **Field Mapping Wizard**   to map Axonius fields to fields in external systems. In this way, you can transfer data found in Axonius into the external system as part of the configuration of relevant enforcement actions. The wizard shows you which fields exist on the Axonius system, allowing you to map them easily.

<Callout icon="📘" theme="info">
  ### Note

  For details, see <Anchor target="_blank" href="https://docs.axonius.com/docs/axonius-to-cmdb-field-mapping#/">Axonius to External Field Mapping</Anchor>.
</Callout>

## Additional Fields

These fields are optional.

**Additional fields** - Specify additional fields to be added as key/value pairs in a JSON format.\
For example:

```json
{"field1": "value1", "field2": "value2"}
```

If one of the specified fields is invalid, the request might fail.

<Callout icon="💡" theme="warn">
  ## Connection and Credentials

When **Use stored credentials from the adapter** is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.

  - **Cherwell Domain** - The hostname or IP address of the Cherwell server (for example, `cherwell.company.com`).

  - **User Name** and **Password** - The credentials of a Cherwell user with permissions to update incidents.

  - **Client ID** - The client ID created in the CSM Administrator. For details, see [Obtaining API Client IDs](https://help.cherwell.com/bundle/cherwell_rest_api_940_help_only/page/oxy_ex-1/content/system_administration/rest_api/csm_rest_obtaining_client_ids.html).

  - **Verify SS&#x4C;_&#x20;(Optional)_**_&#x20;(default: enabled)&#x20;_- Selects whether to verify the SSL certificate of the server against the CA database inside of Axonius.  For more details, see [SSL Trust & CA Settings](/docs/certificate-settings#ssl-trust-ca-settings). This setting is enabled by default on all new adapter settings. If you need to disable SSL verification, make sure you disable this setting._)_&#x20;

  - **HTTPS Proxy** *(optional)* - Connect the adapter to a proxy instead of directly connecting it to the domain.

  - **HTTPS Proxy User Name** _(optional)_ - The user name to use when connecting to the server using the  **HTTPS Proxy**.

  - **HTTPS Proxy Password** *(optional)* - The password to use when connecting to the server using the **HTTPS Proxy**.

  - **Gateway Name** -  Select the Gateway through which to connect to perform the action.
</Callout>

## APIs

Axonius uses the [Cherwell REST API](https://help.cherwell.com/bundle/cherwell_rest_api_940_help_only/page/oxy_ex-1/content/system_administration/rest_api/csm_rest_api_main.html) - POST `api/V1/savebusinessobject`

Axonius also calls the following supporting endpoints:

* POST `token` - To obtain an OAuth 2.0 access token using the password grant type.
* POST `api/V1/GetBusinessObjectTemplate` - To retrieve the incident field template used to map field names and IDs before saving.

## Required Ports

Axonius must be able to communicate via the following ports:

* TCP port 80/443

## Required Permissions

The stored credentials, or those provided in [Connection and Credentials](#connection-and-credentials), must have the following permission(s) to perform this Enforcement Action:

* A Cherwell user account with permissions to update incidents (write access to the Incident business object).
* The account must be able to authenticate via the Cherwell REST API using the password grant type (username, password, and a valid Client ID).
* The Client ID must be created and enabled in the CSM Administrator under **REST API** settings.

***

For more details about other enforcement actions available, see [Action Library](/docs/action-library).