Opening tickets to address vulnerabilities

Edit online

With Concert, you can create tickets in a connected third-party issue tracking system either manually from the UI or automatically by using automation rules.

Use one of the following methods to create tickets for vulnerability issues in your organization's third-party issue tracking system.

Option 1: Configure an automation rule (Recommended)

Configure automation rules to allow Concert to create tickets automatically in your organization's ticketing system based on the risk score or CVSS score associated with the selected application or environment. For instructions, see Automating tickets for prioritized CVEs.
Note: Automation rules are currently not supported for non-CVE exposures.

Option 2: Creating tickets manually

You can also create tickets manually from the Concert UI for individual vulnerability findings.
Note: Only users with the Admin or Editor role can create manual tickets.

Creating tickets for CVEs

  1. Go to Inventory > Applications.
  2. Click the application that contains the vulnerability finding.
  3. Select the required application version.
  4. Open the CVE findings tab.
  5. Locate the required vulnerability finding in the table.
  6. In the Ticket column, click Open ticket for the finding that you want to address.
    Note:
    • You can select multiple rows to create a single manual ticket for multiple findings. Select the checkboxes under Source to choose multiple findings, then click Open Ticket in the blue ribbon that appears, displaying the number of selected items.
    • If a ticket already exists for the selected findings in the same third-party ticketing tool, a new ticket will not be created, and an error message will be displayed. However, if an existing ticket is linked to a different third-party ticketing tool, a new ticket will be created, and only the latest ticket will be displayed in Concert.
  7. Click one option under Type: GitHub, or Jira, ServiceNow, Salesforce, or GitLab.
  8. Select an existing Connection. If there is no existing connection, refer to Connecting with a third-party system for instructions to configure a new connection.
  9. Provide the requested details corresponding to the selected third-party tool.
    • For a GitHub connection, enter the name of the Organization and the name of the Repository. Optionally, you can also select labels from the repository using the Select labels (Optional) field. To fetch existing labels from the repository, click the Refresh button next to the Select labels (Optional) field.
    • For a Jira, enter the Project name.
    • For a ServiceNow connection, no additional information is required.
    • For a Salesforce connection, no additional information is required.
    • For a GitLab connection, choose a Connection and enter Group and Project names.
    Note: By default, the Salesforce and ServiceNow tracking systems do not support HTML template for ticket creation.
    • If your selected third-party tracking system is Salesforce, then you need to create a new custom description field with field name as Custom description and the data type as Rich Text Area to enable the HTML template settings. Refer to the Salesforce documentation.
    • If your selected third-party tracking system is ServiceNow, then you need to update the existing description field with type as String and select the file attachment as HTML. Refer to the ServiceNow documentation.
  10. Optional: Edit the Title and Body fields.
  11. Optional: Enter the email address of the designated assignee in the Assignees field.
  12. Click Open.

After the ticket is created, the ticket number is displayed in the Ticket column for the corresponding vulnerability finding.

Creating tickets for non-CVE exposures

  1. Go to Dimensions > Vulnerability > Exposures tab to see the list of prioritized non-CVE exposures.
  2. Click the required Rule to open its details.
  3. In the assessments table, locate the exposure that you want to address.
  4. In the Ticket column, click Open ticket for the required assessment.
  5. Click one option under Type: GitHub, or Jira, ServiceNow, Salesforce, or GitLab.
  6. Select an existing Connection. If there is no existing connection, refer to Connecting with a third-party system for instructions to configure a new connection.
  7. Provide the requested details corresponding to the selected third-party tool.
    • For a GitHub connection, enter the name of the Organization and the name of the Repository. Optionally, you can also select labels from the repository using the Select labels (Optional) field. To fetch existing labels from the repository, click the Refresh button next to the Select labels (Optional) field.
    • For a Jira, enter the Project name.
    • For a ServiceNow connection, no additional information is required.
    • For a Salesforce connection, no additional information is required.
    • For a GitLab connection, choose a Connection and enter Group and Project names.
    Note: By default, the Salesforce and ServiceNow tracking systems do not support HTML template for ticket creation. If your third-party tracking system is Salesforce or ServiceNow, then you need to do the following changes on your specific third-party tracking system to support the HTML template for ticket creation.
    • If your selected third-party tracking system is Salesforce, then you need to create a new custom description field with field name as Custom description and the data type as Rich Text Area to enable the HTML template settings. Refer to the Salesforce documentation.
    • If your selected third-party tracking system is ServiceNow, then you need to update the existing description field with type as String and select the file attachment as HTML. Refer to the ServiceNow documentation.
  8. Optional: Edit the Title and Body fields.
  9. Optional: Enter the email address of the designated assignee in the Assignees field.
  10. Click Open.

After the ticket is created, the ticket number is displayed in the Ticket column for the corresponding exposure assessment.