Using Dynamic Values in Tickets
==NOT TO PUBLISH UNTIL FURTHER NOTICE==
Use dynamic values to insert asset data into ticket titles and descriptions when Axonius creates tickets. Each value, represented by a chip you insert into the content, resolves to the actual field value from the assets in that ticket group.
How to insert a chip
To insert a dynamic value into a title or description field:
- Select a chip from the token tray below the field.
- Type
{{anywhere in the field to open an inline token picker.
Tokens appear as colored chips in the editor. In Jira, they resolve to plain text.
A live preview below each field shows the resolved values using sample data from the first asset group.
Chip availability
Some tokens are always available. Others become available only when you add a specific field as a grouping level in the Group Assets by Field section.
Always-available chips
These tokens are available regardless of how you group assets.
[PLACEHOLDER: confirm whether case.name, case.priority, and group.name are available in the Generic flow, or whether they are Remediation flow only]
| Token | Resolves to |
|---|---|
{{device.count}} | The number of assets in this ticket's group |
{{assets_list}} | An inline list of assets (up to 50). For groups with more than 50 assets, Axonius attaches a full CSV file and appends a note to the ticket body. |
{{case.name}} | The parent case name |
{{case.priority}} | The case priority |
{{today}} | The current date at ticket creation time |
{{group.name}} | The assignment group name for this ticket |
Split-gated tokens
A split-gated token is available only when its corresponding field is used as a grouping level. When a field is a grouping key, every asset in that group shares the same value for that field — so the token resolves to a single value per ticket.
Example: If you group by Device Type, the token {{device.specific_data.data.device_type}} becomes active. If you remove that grouping level, the token becomes unavailable.
Individual asset fields such as hostname or IP address are not available as inline tokens unless that field is the grouping key. Asset-level data is surfaced through {{assets_list}} or the CSV attachment instead.
The token tray
The token tray below the title and description fields shows all tokens in one of two states:
Active (full opacity, selectable) — the token is valid for the current configuration.
Dimmed (reduced opacity, not selectable) — the token requires a grouping split that isn't configured yet. Hover over a dimmed token to see which split is needed:
"Available after splitting by [field name] in the Group Assets by Field section. When you group tickets by a field, its value becomes unique per ticket and can be inserted here."
Select More to expand the tray. The expanded view shows all active tokens and a separate Unavailable section listing the dimmed tokens.
Removing a split after inserting its token
If you remove a grouping level after inserting its token in the title or description, the token stays in the text but shows a warning border. A validation message appears below the field:
"This token requires a split by [field name]. Re-add the split or remove the token."
Resolve the warning before creating tickets.
Token reference by asset type
Devices
| Token | Label | Type |
|---|---|---|
{{device.specific_data.data.hostname}} | Hostname | Text |
{{device.specific_data.data.hostname_preferred}} | Hostname (preferred) | Text |
{{device.specific_data.data.name_preferred}} | Name (preferred) | Text |
{{device.specific_data.data.network_interfaces.ips_preferred}} | IPs (preferred) | List |
{{device.specific_data.data.name}} | Name | Text |
{{device.specific_data.data.latest_used_user_ad_display_name}} | Last used user | Text |
{{device.specific_data.data.last_seen}} | Last seen | Date |
{{device.specific_data.data.network_interfaces.ips_v4_preferred}} | IPs v4 (preferred) | List |
Users
| Token | Label | Type |
|---|---|---|
{{user.specific_data.data.username}} | Username | Text |
{{user.specific_data.data.user_manager}} | Manager | Text |
{{user.adapters_data.active_directory_adapter.associated_groups.display_name}} | AD groups | List |
{{user.adapters_data.active_directory_adapter.last_seen}} | AD last seen | Date |
{{user.specific_data.data.password_expiration_date}} | Password expiration date | Date |
{{user.adapters_data.azure_ad_adapter.ad_display_name}} | Azure AD display name | Text |
{{user.adapters_data.azure_ad_adapter.ad_user_principal_name}} | Azure AD UPN | Text |
{{user.adapters_data.azure_ad_adapter.last_seen}} | Azure AD last seen | Date |
Vulnerabilities
| Token | Label | Type |
|---|---|---|
{{vulnerability.specific_data.data.cve_id}} | CVE ID | Text |
{{vulnerability.specific_data.data.cve_description}} | CVE description | Text |
{{vulnerability.specific_data.data.axonius_risk_score}} | Axonius risk score | Number |
{{vulnerability.specific_data.data.publish_date}} | Publish date | Date |
{{vulnerability.specific_data.data.first_seen_by_source}} | First seen by source | Date |
{{vulnerability.specific_data.data.suggested_remediations.description}} | Suggested remediations | Text |
{{vulnerability.adapters_data.static_analysis_nvd.cve_description}} | CVE description (NVD) | Text |
{{vulnerability.devices_count}} | Device count | Number |
Vulnerability Instances and Findings
| Token | Label | Type |
|---|---|---|
{{vulnerability_instance.specific_data.data.remediation_owner}} | Remediation Owner | Text |
{{vulnerability_instance.specific_data.data.hostname_preferred}} | Hostname (preferred) | Text |
{{vulnerability_instance.specific_data.data.plugin_name}} | Plugin name | Text |
{{vulnerability_instance.specific_data.data.plugin_id}} | Plugin ID | Number |
{{vulnerability_instance.specific_data.data.plugin_severity}} | Plugin severity | Text |
{{vulnerability_instance.specific_data.data.first_seen}} | First seen | Date |
{{vulnerability_instance.specific_data.data.last_seen}} | Last seen | Date |
{{vulnerability_instance.specific_data.data.axonius_risk_score}} | Axonius risk score | Number |
{{vulnerability_instance.specific_data.data.plugin_solution}} | Plugin solution | Text |
Null value behavior
If a token's field has no value for some assets in a group, that token resolves to "NULL" in the created ticket.
Example:
Title template: {{device.specific_data.data.hostname_preferred}} has security findings
Result when hostname is missing: NULL has security findings
When Axonius detects a null-value risk, a warning appears below the title or description field:
"{{token}} may be blank. N assets have no value for [field name]. You can configure how to handle these assets in the Group Assets by Field section."
Updated about 1 hour ago