Manage Ticketing

Managing tickets includes:

• Viewing open and closed tickets
• Examining ticket details and progress
• Closing tickets
• Changing settings that control how tickets work in a space

View tickets

On the Ticketing page in the Mondoo App, you can view all the open and closed tickets in a space and see the progress made toward fixing the assets they track. To view tickets in a space:

1. In the Mondoo App, navigate to the space.

   To view only the tickets in a certain workspace, navigate to that workspace.

2. In the side navigation bar, select Ticketing.

   Mondoo lists the tickets in the space or workspace. Use the All, Open, and Closed tabs to filter by status, or the search box to find a specific ticket. For each ticket, the list shows its title (with the finding it tracks), a Progress bar of how many affected assets are fixed, any linked External Ticket, the date Created, and its Status. To export the current view, select Copy Table to Clipboard.

   

3. Select a ticket to see its details.

   

Close a ticket

Close a ticket to indicate that the work is completed or to stop tracking it. You can close a ticket from the list of tickets or from the ticket detail page.

Note: Only team members with Editor or Owner access can perform this task.

1. In the Mondoo App, navigate to the space.

2. In the side navigation bar, select Ticketing.

   Status bars show progress made by fixing the assets tracked in each ticket.

   

3. To close the ticket, either:

   • In the ticket's row, select its status menu (Open), then select Close ticket.

   

   Or

   • Select the ticket to open its detail page, then select ACTIONS near the top-right corner and choose Close ticket.

   

Automatically create tickets on drift

Drift occurs when, instead of improving security, an asset becomes more vulnerable to attack:

• An asset previously passed a check in a policy but is now failing that check
• Mondoo previously did not detect a vulnerability on an asset, but now does detect that vulnerability

It's important to catch drift quickly. Mondoo makes that possible with automatic drift detection. When an asset becomes less secure, Mondoo can automatically create a ticket to alert you of the change and track the work on resolving the problem.

Drift detection runs continuously: Mondoo flags drift the moment a scan reveals that an asset has regressed (a previously passing check now fails, or a previously undetected vulnerability is now detected).

The Regression setting controls whether Mondoo opens a ticket when it detects drift. You'll find it under Settings > Ticketing, in the Ticket Processing section.

To enable or disable automatic drift tickets:

Note: Only team members with Editor or Owner access can perform this task.

1. Navigate to the space where you want to change the drift setting.

2. In the left navigation, select Settings.

3. Select Ticketing.

4. In the Ticket Processing section, turn Regression on or off.

Choose a destination for drift tickets

Like all tickets, Mondoo can share automatically created drift tickets with your ticket system. When you add a new ticketing integration, you choose whether to create drift tickets. You can also change this option any time in the space settings: Enable or disable Create drift issues/tickets in this integration. For direct integrations, you also specify the default destination for drift tickets.

To choose a destination for automatic drift tickets:

Note: Only team members with Editor or Owner access can perform this task.

1. Navigate to the space where you want to change the drift setting.

2. In the left navigation, select Settings.

3. Select Ticketing.

4. Locate the settings for your integration and enable or disable Create drift issues/tickets in this integration.

5. For direct integrations, specify where to create drift issues/tickets.

Group similar drift occurrences into one ticket

If the same drift occurs on multiple assets, you may not want a separate ticket for each asset. Mondoo can group the drift detection of multiple assets into a single ticket. To do this, it waits a configurable period of time before finalizing the Mondoo ticket and creating an issue or ticket in your external tracking system.

For example, suppose you configure Mondoo to create a new ticket and a corresponding Jira issue whenever it detects drift. You also configure Mondoo to wait four hours to group multiple instances of the same drift into one ticket. Mondoo scans asset 1, which fails check X. Mondoo identifies that asset 1 previously passed check X. This is drift, so Mondoo generates a ticket. However, Mondoo doesn't immediately save the ticket or create a Jira issue. Instead, Mondoo waits four hours to determine if any other assets also have incurred drift on check X. During these four hours, asset 5 and asset 6, which previously passed check X, now fail check X. Instead of creating new tickets for assets 5 and 6, Mondoo adds information about assets 5 and 6 to the ticket initially created for asset 1. Now there is a single ticket with information about the three assets that incurred drift on check X. When four hours have passed, Mondoo creates a single Jira issue with the details about asset 1, asset 5, and asset 6 all incurring drift on check X.

The Aggregation space setting controls how long Mondoo waits to group similar drift occurrences in a single ticket. You either choose a time period or choose No aggregation to create a unique ticket (and corresponding issue or ticket) for each asset that incurs the same drift.

To automatically group similar drift occurrences into one ticket:

Note: Only team members with Editor or Owner access can perform this task.

1. Navigate to the space where you want to change the drift settings.

2. In the left navigation, select Settings.

3. Select Ticketing.

4. In the Aggregation drop-down list, choose how long to wait to detect the same drift on other assets before finalizing a ticket and creating an issue/ticket in your ticket system.

Choose whether to close external tickets/issues when you close Mondoo tickets

This setting applies only to direct integrations (Jira, GitHub, GitLab, Zendesk, Azure DevOps), not to email integrations.

When enabled, closing a Mondoo ticket in the Mondoo App also closes the corresponding issue or ticket in your external tracking system.

Note: Only team members with Editor or Owner access can perform this task.

1. Navigate to the space where you want to change the closing behavior.

2. In the left navigation, select Settings.

3. Select Ticketing.

4. In the Connected integrations list, turn Auto-close on or off for the integration.

Learn more

• Track and Fix Findings with Ticketing
• Set up Ticketing and Azure DevOps
• Set up Ticketing and GitHub
• Set up Ticketing and GitLab
• Set up Ticketing and Jira
• Set up Ticketing and Zendesk
• Set up Ticketing to Email Your External Ticket System
• Create Tickets from Advisories
• Create Tickets from Checks