Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
The command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
SKILL.md
Source instructions · Read-only preview
name
implementing-ticketing-system-for-incidents
description
Implements an integrated incident ticketing system connecting SIEM alerts to ServiceNow, Jira, or TheHive for structured incident tracking, SLA management, escalation workflows, and compliance documentation. Use when SOC teams need formalized incident lifecycle management with automated ticket creation, assignment routing, and resolution tracking.
SOC teams need to formalize incident tracking beyond SIEM notable event management
Compliance requirements mandate documented incident lifecycle with timestamps and audit trails
Multi-team coordination requires ticket-based workflows with assignment and escalation
SLA tracking needs automated measurement of response and resolution times
Post-incident reviews require structured data for trend analysis and reporting
Do not use for individual alert triage — ticketing is for confirmed incidents requiring multi-step investigation and remediation, not every SIEM alert.
Common Misconfigurations & Verification
Auto-close without resolution: workflows that set state=6/Resolved (or fire resolve_incident) on every SIEM webhook close tickets with no close_notes, close_code, or disposition, destroying audit evidence. Confirm closed tickets carry a non-empty disposition (true/false positive) and that closure is gated on analyst action, not the create call.
Duplicate tickets per alert: missing dedup on u_siem_event_id/notable_id means one notable spawns dozens of incidents. Verify a repeat alert updates the existing ticket (add work note) instead of opening a new one.
SLA clock wrong:opened_at parsed with the wrong timezone or strptime format makes age_minutes negative or hugely inflated, so the auto-escalation either never fires or fires instantly. Validate against a ticket with a known open time.
Assignment/severity drift:severity_map/_get_assignment_group defaulting to medium/Tier 1 when the alert severity field is absent silently downgrades critical incidents. Confirm urgency/impact and assignment group match the taxonomy for a critical test alert.
Verify end to end: fire a critical and a low test alert, confirm exactly one ticket each, correct severity→assignment_group routing, SLA timers counting from the right opened_at, escalation on breach, and that resolution requires a disposition before the ticket can close.
Prerequisites
Ticketing platform: ServiceNow ITSM, Jira Service Management, or TheHive
SIEM integration capability (REST API, webhook, or SOAR connector)
Establish standardized incident categories and severity:
incident_taxonomy:categories:-malware_infection-phishing_campaign-unauthorized_access-data_exfiltration-denial_of_service-ransomware-insider_threat-vulnerability_exploitation-account_compromise-policy_violationseverity_levels:critical:definition:"Active data breach, ransomware, or business-critical system compromise"response_sla:15minutesresolution_sla:4hoursescalation:immediatetoTier3+CISOnotificationexamples: ["Active ransomware", "Domain admin compromise", "Customer data breach"]
high:definition:"Confirmed compromise of business systems or multiple user accounts"response_sla:30minutesresolution_sla:8hoursescalation:Tier2immediate,Tier3ifunresolvedin2hoursexamples: ["Malware with C2", "Lateral movement detected", "Phishing with credential theft"]
medium:definition:"Confirmed security event requiring investigation and remediation"response_sla:2hoursresolution_sla:24hoursescalation:Tier2within4hoursexamples: ["Single phishing click", "Unauthorized software", "Policy violation"]
low:definition:"Minor security event with limited impact"response_sla:8hoursresolution_sla:72hoursescalation:Tier1standardqueueexamples: ["Scan attempt", "Failed brute force (no compromise)", "Info disclosure"]
