Security Incident Tickets

Reference

What a Jira or ServiceNow ticket for a security incident contains, how destinations are configured, and the API that creates tickets. To set it up, see Create Jira and ServiceNow tickets.

Ticket content

Part	Source
Title	[AIControls <Severity>] and the plain-English title from the Security Finding Catalog. When the type is not in the catalog, the policy or event type. At most 200 characters.
Severity, status	The incident's highest severity, and its triage status (New, Acknowledged or Resolved).
Assignee, actor	The triage assignee and the user, agent or workload acting. Omitted when the destination redacts actors.
Target	The incident target, with its cluster.
Why it matters, recommended action	The catalog text.
MITRE techniques	The ATLAS and ATT&CK techniques from the catalog, with IDs and names.
Times and count	First seen, last seen and the number of findings.
Link	The incident in the UI. Present only when ui.publicURL is an absolute URL that doesn't name this machine (such as localhost or 127.0.0.1).
Summaries	Up to 5 finding summaries, each cut to 500 characters, only for a destination with Include finding summaries, after credentials and personal data are redacted.

When the destination redacts actors, the incident ID (which is encoded from the actor) is replaced everywhere by an opaque hash keyed on a server secret of the deployment (the session secret), not on any destination credential, so it stays the same when you rotate a credential. The incident link is left out, and the ServiceNow correlation_id carries the same hash. If the deployment has no such secret, the incident reference is left out instead.

Never included: evidence items and excerpts, prompts and responses, blob references, the triage note, and credentials.

Jira Cloud receives POST /rest/api/3/issue with the description in Atlassian Document Format and Basic authentication (email and API token). The result is the issue key, linked as <base URL>/browse/<key>.

ServiceNow receives POST /api/now/table/<table> with short_description, a plain-text description, urgency, impact, optionally priority and assignment_group, and correlation_id set to the incident ID. Authentication is Basic, or a bearer token from POST /oauth_token.do with the client credentials grant. The result is the record number and sys_id.

Destination settings

Destinations are saved as the ticketing managed integration, {"destinations": [...]}, up to 10. Credentials and account identities (email, apiToken, username, password, clientId, clientSecret) are masked when the configuration is read, and a field that is not listed here is refused.

Field	Applies to	Meaning
name	Both	Required and unique. Letters, digits, space, dot, dash and underscore, at most 40.
type	Both	jira or servicenow.
baseUrl	Both	Required. HTTPS (HTTP only for loopback). No path, query, fragment or user info.
minSeverity	Both	medium, high or critical. Empty means no filter for Create ticket for all destinations.
eventTypes	Both	Optional list of event types.
autoCreate	Both	off (default) or on. When on, the threshold is minSeverity, or critical when it is empty.
redactActors, includeSummaries	Both	Off by default.
priorityMap	Both	Severity (critical, high, medium, low) to a Jira priority name, or to a ServiceNow priority from 1 to 5.
email, apiToken	Jira	Required.
projectKey	Jira	Required. Upper case, such as SEC.
issueType	Jira	Defaults to Task.
labels	Jira	Up to 10 extra labels without spaces. aicontrols is always added.
customFields	Jira	Up to 10 entries of customfield_<number> to a text value.
authMode	ServiceNow	basic (default) or oauth.
username, password	ServiceNow	Required for basic.
clientId, clientSecret	ServiceNow	Required for oauth.
table	ServiceNow	Defaults to incident. Use sn_si_incident for Security Incident Response.
assignmentGroup	ServiceNow	Optional. The 32-character sys_id of the group.
urgencyMap, impactMap	ServiceNow	Severity to 1, 2 or 3.

Delivery and idempotency

An incident has one ticket per destination. The ticket reference is kept in the configuration audit trail, so a second request returns the existing ticket without calling the ticket system. The trail follows its retention setting (365 days by default); once a record is pruned the link is gone, and a 34-day marker only stops a second ticket (the request reports ref_unrecorded). Creation for one incident and destination is serialized across replicas.

A request is sent up to 3 times, with 1 and 2 second backoff, only when the connection is refused or the system answers 429. A timeout, a reset or a 5xx is not retried, because the ticket may already exist. The incident is then not ticketed again for that destination until you check the ticket system (the drawer reports that the reference was not recorded); a 4xx can be retried at once. Redirects are not followed, environment proxy settings are ignored, and the base URL may not be a cloud metadata or link-local address.

Every attempt is recorded in the configuration audit trail as security_incident.ticket_created with the outcome (success or failed), the trigger, the system type, the destination name and host, the attempt count, the HTTP status, and on success the ticket key, ID and link. The metric aicontrols_security_ticket_total{trigger,outcome} counts attempts.

API

Route	Access	Purpose
GET /api/v1/security-incidents/{id}/tickets	Administrators and viewers	Whether any destination is configured, and for each its name, type, automatic mode, severity filter and this incident's ticket (key, link, time, trigger, actor).
POST /api/v1/security-incidents/{id}/ticket	Administrators	Create the ticket now. The optional body {"destination": "name"} picks one destination; without it every destination whose filters accept the incident is used. Returns 200 with a results list (created, exists, failed, in_progress or ref_unrecorded for each destination, with the ticket or a failure reason); status is ok or partial. 502 when every destination failed; ref_unrecorded also covers a timeout or 5xx after which a ticket may exist; 409 when none is configured, none accepts this incident, or a ticket is being created.