Tickets

Tickets are the unit of work in the SOC. Each ticket has a human-readable number, a title and description, a priority, a status, a category, and a source. Tickets can be linked to alerts, assigned to a user, tagged, and discussed through a comment thread that mixes analyst comments, internal notes, and automatically generated system entries.

Ticket numbers

Every ticket gets a unique number. If one is not supplied on creation, the API generates it in the form TKT-{year}-{00000} — the current year plus a zero-padded 5-digit value, for example TKT-2026-04217.

Lifecycle

Status moves through five stages. When a ticket is set to resolved the API stamps resolvedAt; setting it to closed stamps closedAt.

open → in_progress → pending → resolved → closed

Automatic system trail

Creating a ticket adds a system comment (“Ticket created by …”). Changing status, priority, or assignee through the API appends further system comments so the thread doubles as an audit trail of what changed and when.

The page is a split view: a filterable ticket list on the left and, when a ticket is selected, a detail panel on the right. The header summarizes the currently loaded tickets — open count, critical count, and how many have breached SLA.

Finding tickets

• Search — a debounced search box matches against ticket title and description.
• Status tabs — All, Open, In Progress, Pending, Resolved, Closed. The list opens on Open by default.
• Priority — filter to Critical, High, Medium, or Low.
• My Tickets — toggles to only tickets assigned to you.

The list shows a priority icon, number, title (with the AI category beneath it when present), assignee, status, comment count, an SLA flag, and last-updated time. You can also deep-link straight to a ticket by opening /tickets?ticketId=THE_ID, which selects it automatically.

Creating a ticket

Use + New Ticket to open the create dialog. Title is required; you can also set a description, a priority (critical / high / medium / low), and a category (incident / alert / task / change / vulnerability). On save the new ticket opens in the detail panel.

Working a ticket

The detail panel’s right rail is where you drive the ticket:

• Status and Priority — click a value to change it; the change is written immediately and recorded as a system comment.
• Assignee — reassign from the organization’s user list (populated from the admin users endpoint).
• Tags — add a tag by typing and pressing Enter, or remove one with its × button.
• SLA clock — a Running / Paused toggle that adds or removes the sla-paused tag and logs an internal note. A paused ticket shows an “SLA PAUSED” badge; a ticket whose slaBreached flag is set shows an “SLA BREACHED” warning.
• Info — created / updated times, reporter, source, category, and due date.

Comments, alerts, and AI analysis

The left side of the detail panel has three tabs:

• Comments — the description plus the full thread. The composer posts a comment (Ctrl/Cmd+Enter also posts); tick Internal note to mark it internal. System entries render as inline dividers and AI entries are styled distinctly.
• Alerts — the security alerts linked to this ticket via its alertIds, each showing severity, source, raw message, and age.
• AI Analysis — when the ticket has stored triage analysis, it renders the threat score, category, verdict, false-positive likelihood, MITRE ATT&CK technique, summary, and recommended action.

Escalation and AI actions

For tickets whose category is not already incident, an Escalate button creates a linked case in the incident workspace, switches the ticket to category incident and status in_progress, and logs an internal note referencing the new incident number. On the AI Analysis tab, a Run Auto-Remediation Playbook button records the AI’s recommended action as an internal note and marks the ticket resolved.

Controlled values

Key ticket fields

Comments

Each comment carries content, an author, a type, and an internal flag. Posting a comment updates the parent ticket’s updatedAt. Comment content is scanned for sensitive data on submission; a match raises a DLP alert but the comment is still saved.

All endpoints require an authenticated portal session and operate within the caller’s organization.

List tickets

Supported query parameters: status, priority, assignee (an assignee ID), mine=true (assigned to you), search (matches title or description), and limit (default 100). The response returns tickets (each with a commentCount), total, and the aggregate breakdowns byStatus and byPriority.

curl "https://portal.guardfoxsecurity.com/api/tickets?status=open&priority=high&limit=50"

Create a ticket

Only title is effectively required. Accepted body fields include title, description, priority, status, category, source, severity, alertIds, assigneeId, assigneeEmail, tags, dueAt, and an optional number. The reporter is taken from your session. Returns 201 with the created ticket.

curl -X POST https://portal.guardfoxsecurity.com/api/tickets \
  -H "Content-Type: application/json" \
  -d '{"title":"Suspicious PowerShell on HR-LAPTOP-04","description":"Encoded command spawned by winword.exe","priority":"high","category":"incident"}'

Update a ticket

PATCH accepts any of status, priority, assigneeId + assigneeEmail, title, description, dueAt, tags, and alertIds. Status, priority, and assignee changes each append a system comment; resolving or closing also stamps the matching timestamp.

curl -X PATCH https://portal.guardfoxsecurity.com/api/tickets/TICKET_ID \
  -H "Content-Type: application/json" \
  -d '{"status":"in_progress","assigneeId":"USER_ID","assigneeEmail":"[email protected]"}'

Add a comment

Body fields: content (required — empty content returns 400), internal (boolean), and an optional type. Returns 201 with the created comment.

curl -X POST https://portal.guardfoxsecurity.com/api/tickets/TICKET_ID/comments \
  -H "Content-Type: application/json" \
  -d '{"content":"Confirmed benign - matches the scheduled admin script.","internal":true}'