Secureworks CTP Master Ticket Closure Notice

Before you close a security incident created by a Secureworks CTP master ticket, you must verify that all child tickets associated with the master ticket are closed.

시작하기 전에

Role required: sn_si.admin

프로시저

1. Navigate to All > Secureworks Ticket Ingestion > Secureworks Ticket to Task.
   The Secureworks CTP tickets with their corresponding security incidents are displayed.

   
   
   
2. Click on the security incident with the isGlobalParent field set to true.
3. Change the security incident State to Closed, specify the close codes and click Save.
   The following dialog box is displayed.

   
   
   

   This security incident is associated with a Secureworks Master Ticket. A Master Ticket may have one or more child tickets associated with it. Before the Master Ticket can be closed, you must first verify if all the child tickets associated with this Master Ticket are closed.

4. Add a note requesting closure of the Master Ticket in Secureworks and click Submit Request.
   The Master Ticket is now reassigned to the Secureworks SOC team.
5. Once the request has been submitted, you can close the security incident.
6. Navigate to Application > Module.