Ticket Handling

The Tickets module is the core incident management component of Argus. It provides a full lifecycle system for tracking security incidents from creation through resolution, with built-in SLA monitoring, AI-assisted analysis, collaborative investigation, and a SOAR workflow engine.

Tickets

Navigation

Click Tickets in the left sidebar to open the Tickets module.

Ticket List View

The list provides a unified view of all active incidents with filtering, sorting, and chart visualization.

Key Features

Table Columns

Creating a Ticket

1. Click Create Ticket in the top-right of the list.
2. Fill in required fields:
   • Title — brief incident summary
   • Priority — Critical, High, Medium, or Low
   • Description — detailed incident description
   • Assigned User — responsible analyst
3. Fill in optional fields as needed:
   • Event Category — e.g., Malware, Denial of Service, Account Anomalies
   • Event Sources — SIEM, EDR, Firewall
   • Event Platform — Windows, Linux, AWS
   • Labels — key-value pairs for categorization and automation
4. Click Submit.

The system generates a unique ticket number and starts SLA tracking automatically.

Ticket Detail View

Click any ticket row to open the detail view.

Tabs

Ticket Lifecycle

New → Acknowledged → Triaged → Contained → Resolved → Closed

Updating status — Option 1 (recommended): Decision buttons

Context-sensitive buttons appear at the top of the Incident tab:

• Acknowledge — available when New
• Triage — available when Acknowledged
• Contain — available when Triaged
• Resolve — available when Triaged or Contained (opens a resolve dialog)

Updating status — Option 2: Status dropdown

Use the status dropdown and click Update Status to set any valid state manually.

Resolve dialog fields:

• Event Category — root cause classification
• Event Result — True Positive / False Positive / True Positive - Benign
• Notes — resolution summary

Pending state: Toggle Pending to temporarily pause SLA timers. Pending intervals are subtracted from SLA calculations.

SLA Tracking

SLA buckets in the list view:

• Green <=1h — within target
• Yellow 1–4h — approaching breach
• Red >4h — SLA breached

War Room

The War Room consolidates all investigative artifacts for a ticket.

Adding a work log:

1. Type in the text area at the bottom.
2. Paste images directly (Ctrl+V / Cmd+V) — auto-uploaded and embedded.
3. Click Send.

AI Assistant

Click AI Assistant (or the lightning bolt icon) to generate:

• Alert Explanation — plain-language description
• Risk Level Recommendation — suggested severity with rationale
• Completed Tasks — actions the AI has already performed
• Next Tasks — recommended analyst follow-up

AI Chat: Click Chat to open an interactive conversation scoped to the current ticket. Chat history persists per ticket.

@ai mention: In the comment box, type @ai <question> to post an AI response directly to the work log.

@playbook mention: Type @playbook <name> to invoke a workflow playbook with the current ticket as context.

Labels and Observables

Labels are key-value pairs used for categorization and workflow automation:

1. Go to the Labels section in the ticket detail.
2. Click Add Label, enter name and value, click Save.

Labels can trigger automatic workflow bindings and filter tickets in the list.

Observables are extracted indicators (IPs, domains, hashes) that appear in the Evidence tab, populated by AI analysis or manual entry.

Batch Operations

Select multiple tickets with checkboxes to access batch actions:

Workflows (SOAR)

The Workflows module is the SOAR engine that automates repetitive tasks, orchestrates multi-step response procedures, and integrates with external tools.

Navigation: Settings → Workflows

Workflow List View

Four summary cards at the top show: Total Workflows, Active, Total Executions, Success Rate.

Table Columns

Quick Actions

Visual Workflow Editor

Click Create Visual Workflow or the branch icon on an existing workflow.

Editor Layout

Building a Workflow

1. Set the workflow name.
2. Select the trigger type.
3. Drag action nodes from the palette onto the canvas.
4. Connect nodes by dragging from one handle to another.
5. Click each node and fill in its configuration in the right panel.
6. Click Save to persist as a draft.

Node Types

Trigger Types

Filter condition example — trigger only for critical malware incidents:

{
  "priority": ["critical", "high"],
  "event_category": ["malware"]
}

Execution History

Navigate to Settings → Workflows → View Executions.

Click an execution to view step-by-step timeline, error details, accumulated context variables, and full execution logs.

Cron Schedule Examples

Ticket-Workflow Bindings

Bindings trigger workflows automatically based on ticket labels:

1. Configure label filters on the workflow (name + value pairs).
2. Choose logic: AND (all labels must match) or OR (any label may match).

When a ticket event occurs, the system evaluates all active bindings and dispatches matching workflows with the ticket as trigger context.

Invoking Playbooks from Tickets

Workflows with Is Callable from Ticket enabled can be invoked directly from a ticket.

Method 1 — @playbook command: In the comment box, type @ and select a playbook from the dropdown, then click Send.

Method 2 — Playbook panel: Open the ticket detail, navigate to the playbook section, and click Invoke.

Each ticket shows a Workplan listing all associated workflow executions with status, progress, and timestamps.