Sending case to a third party tickiting system

[A.BELKAHLA]

Hello, 

i hope you re doing well i want to know the steps to send cases when there generated to our third party tickiting system , how to do it via API or weebhook.

can someone already worked on a similare case share with me all the steps and configuration required.

thanks in advance

Cortex XDR 

[susekar]

Hello @A.BELKAHLA ,

Greetings for the day.

To send Cortex XDR incidents (cases) to a third-party ticketing system, you should use the Forwarding feature in combination with a Webhook or the Public API.

I have outlined the specific steps and configurations below.

Step 1: Create a Webhook Integration Profile

First, you must define the connection details for your ticketing system.

1. Log in to the Cortex XDR console.

2. Navigate to Settings > Configurations > Integrations > External Services.

3. Click + Add Webhook.

4. Configure the following fields:

   • Name: A descriptive name (e.g., Corporate_Jira_Service_Desk).

   • URL: The API endpoint of your ticketing system (e.g., https://api.yourticketing.com/v1/tickets).

   • Method: Select POST.

   • Headers: Add any required headers for authentication (e.g., Authorization: Bearer <token> and Content-Type: application/json).

5. Payload Configuration:

   • Select Custom Payload to match the JSON schema required by your ticketing system.

   • Use dynamic placeholders to map Cortex data to your ticket fields. Common placeholders include:

     • ${incident_id}: The unique XDR incident ID.

     • ${description}: Summary of the threat.

     • ${severity}: Critical, High, Medium, or Low.

     • ${incident_sources}: The originating security modules.
       
       

Step 2: Configure Incident Forwarding Rules

Once the webhook is defined, you must tell Cortex XDR which incidents to send.

1. Navigate to Settings > Configurations > General > Forwarding.

2. Click + New Rule.

3. Set the following parameters:

   • Status: Enabled.

   • Log Type: Select Incident.

   • Filters: Define which incidents trigger a ticket. (e.g., Severity = High OR Severity = Critical).

   • Target: Select the Webhook profile you created in Step 1.

4. Click Save.
   
   

Step 3: Verification

1. Within the Webhook configuration screen, use the Test button to send a sample payload to your ticketing system.

2. Verify that a "test" ticket is successfully created in your third-party system.

3. Check the Jobs or System Logs in Cortex XDR if the test fails to troubleshoot connectivity or authentication errors.

 

Alternative: Pulling via Public API

If your system prefers to "pull" data rather than receive "pushes," use the following:

1. Generate API Key: Go to Settings > Configurations > Integrations > API Keys and create a key with Security Admin or Instance Administrator permissions.

2. API Endpoint: Use POST /incidents/get_incidents/.

3. Logic: Configure your internal system to query this endpoint every 5–10 minutes, filtering for incidents with a creation_time newer than the last successful pull.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar