Does your organization automatically generate and assign tickets in your ticketing system when specific security alerts are triggered?
Explanation
Automatic ticket creation ensures that security alerts are promptly addressed by creating accountability through assignment and providing a trackable workflow. This practice helps prevent alerts from being overlooked during high-volume incidents and establishes a documented response history for each security event. The automation reduces response time and human error in the triage process.
Evidence could include screenshots of the automation configuration in your SIEM or alert management system, workflow diagrams showing the alert-to-ticket process, or examples of automatically generated tickets with their corresponding security alerts (with sensitive information redacted).
Implementation Example
Automatically create and assign tickets in the organization's ticketing system when certain types of alerts occur
ID: DE.AE-06.301
Context
- Function
- DE: DETECT
- Category
- DE.AE: Adverse Event Analysis
- Sub-Category
- Information on adverse events is provided to authorized staff and tools
Related questions
- Has your organization established and maintained a baseline of network operations and expected data flows for users and systems?
- Does your organization use SIEM or similar tools to continuously monitor log events for malicious and suspicious activity?
- Does your organization integrate current cyber threat intelligence feeds into your log analysis and monitoring tools?
- Does your organization conduct regular manual reviews of log events for systems that cannot be adequately monitored through automated means?
- Does your organization utilize log analysis tools to generate actionable reports from log data?
- Does your organization centralize log data by continuously transferring logs from multiple sources to a consolidated set of log servers?
