Create a ServiceNow or JIRA Ticket

If you use ticketing or case management services in your environment, such as JIRA or ServiceNow, you can use out of the box workflows to automatically create tickets from your Investigations.

Before You Begin

After you install the Rapid7 Orchestrator (Insight Orchestrator), make sure that you configure the appropriate connections for automating workflows.

Create a Ticket with ServiceNow

To configure a workflow that will automatically create a ticket in ServiceNow:

From Command Home, go to Alerts > Investigations.
Open the desired investigation. You will see a timeline of events involving the user.
From the Select an Action Category dropdown, select Custom Workflows.
From the Select an Automation Action to Take dropdown, select Create Incident Report in ServiceNow.
Select the ServiceNow connection you want to use and select Continue.
Select the Associated Alert.
Select the Associated Actor.
Select the Associated Asset.
Select Take Action.

The event will appear on the Investigation timeline when the process completes.

Create a Ticket with Jira

To configure a workflow that will automatically create a ticket in Jira:

From Command Home, go to Alerts > Investigations.
Open the desired investigation. You will see a timeline of events involving the user.
Select the Take Action button. The Take Action panel appears.
From the Select an Action Category dropdown, select Custom Workflows.
From the Select an Automation Action to Take dropdown, select Create Issue in Jira.

⚠️

You can only create a Story ticket

You can only automatically create Story tickets in Jira from a SIEM (InsightIDR) workflow. If you have a license to Automation (InsightConnect) , Rapid7’s SOAR tool, you can automatically create other Jira ticket types from a SIEM (InsightIDR) workflow.

Select the Associated Alert.
Select the Associated Actor.
Select the Associated Asset.
Select Take Action.

The event will appear on the Investigation timeline when the process completes.