Ticket Workflow

Ticket Handling Process

Purpose

Ticket tracks the entire incident handling cycle through Phases (according to standards like ISO 27035). Supports comments, replies, and Ticket Tasks to assign work.

Steps

1. Create Ticket (manual / from Event / SOAR).
2. Assign Assignee and Priority.
3. Conduct investigation: collect evidence, hunting, run playbook.
4. Notes, upload attachment, update status/phase.
5. Complete: move ticket to Closed and save record for audit.

Best Practices

• Clearly describe scope and impact in Content.
• Attach logs/screenshots/IOC to facilitate investigation.
• Use Ticket Tasks to break down work instead of having one overly large ticket.