Sending case to a third party tickiting system

A.BELKAHLA — Thu, 13 Aug 2026 08:11:46 GMT

Hello,

i hope you re doing well i want to know the steps to send cases when there generated to our third party tickiting system , how to do it via API or weebhook.

can someone already worked on a similare case share with me all the steps and configuration required.

thanks in advance

Re: Sending case to a third party tickiting system

susekar — Thu, 13 Aug 2026 13:07:08 GMT

Hello @A.BELKAHLA ,

Greetings for the day.

To send Cortex XDR incidents (cases) to a third-party ticketing system, you should use the Forwarding feature in combination with a Webhook or the Public API.

I have outlined the specific steps and configurations below.

Step 1: Create a Webhook Integration Profile

First, you must define the connection details for your ticketing system.

Log in to the Cortex XDR console.
Navigate to Settings > Configurations > Integrations > External Services.
Click + Add Webhook.
Configure the following fields:
- Name: A descriptive name (e.g., Corporate_Jira_Service_Desk).
- URL: The API endpoint of your ticketing system (e.g., https://api.yourticketing.com/v1/tickets).
- Method: Select POST.
- Headers: Add any required headers for authentication (e.g., Authorization: Bearer <token> and Content-Type: application/json).
Payload Configuration:
- Select Custom Payload to match the JSON schema required by your ticketing system.
- Use dynamic placeholders to map Cortex data to your ticket fields. Common placeholders include:
  - ${incident_id}: The unique XDR incident ID.
  - ${description}: Summary of the threat.
  - ${severity}: Critical, High, Medium, or Low.
  - ${incident_sources}: The originating security modules.

Step 2: Configure Incident Forwarding Rules

Once the webhook is defined, you must tell Cortex XDR which incidents to send.

Navigate to Settings > Configurations > General > Forwarding.
Click + New Rule.
Set the following parameters:
- Status: Enabled.
- Log Type: Select Incident.
- Filters: Define which incidents trigger a ticket. (e.g., Severity = High OR Severity = Critical).
- Target: Select the Webhook profile you created in Step 1.
Click Save.

Step 3: Verification

Within the Webhook configuration screen, use the Test button to send a sample payload to your ticketing system.
Verify that a "test" ticket is successfully created in your third-party system.
Check the Jobs or System Logs in Cortex XDR if the test fails to troubleshoot connectivity or authentication errors.

Alternative: Pulling via Public API

If your system prefers to "pull" data rather than receive "pushes," use the following:

Generate API Key: Go to Settings > Configurations > Integrations > API Keys and create a key with Security Admin or Instance Administrator permissions.
API Endpoint: Use POST /incidents/get_incidents/.
Logic: Configure your internal system to query this endpoint every 5–10 minutes, filtering for incidents with a creation_time newer than the last successful pull.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".