DE.AE-06.301
Does your organization automatically generate and assign tickets in your ticketing system when specific security alerts are triggered?
Explanation
Automatic ticket creation ensures that security alerts are promptly addressed by creating accountability through assignment and providing a trackable workflow. This practice helps prevent alerts from being overlooked during high-volume incidents and establishes a documented response history for each security event. The automation reduces response time and human error in the triage process. Evidence could include screenshots of the automation configuration in your SIEM or alert management system, workflow diagrams showing the alert-to-ticket process, or examples of automatically generated tickets with their corresponding security alerts (with sensitive information redacted).
Implementation Example
Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur
ID: DE.AE-06.301
Context
- Function
- DE: DETECT
- Category
- DE.AE: Adverse Event Analysis
- Sub-Category
- Information on adverse events is provided to authorized staff and tools

