> For the complete documentation index, see [llms.txt](https://docs.cybaops.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cybaops.com/modules/detect-and-respond-mdr/ticket-creation.md).

# Ticket Creation

## <mark style="color:$primary;">Creating a Ticket</mark>

You can create a ticket that can be managed by either your internal team, or by a delivery team. When creating a ticket you will be asked for a **Ticket Title**, **Short Description (optional)**, **Customer Contact (optional)**, **Contact Group (optional)**, **Assignee** and **Team**.&#x20;

## <mark style="color:$primary;">Permissions</mark>

When creating a ticket, you can control who has access to it by selecting a **Customer Contact**, **Customer Group**, **Assignee** and **Team**.

{% hint style="info" %}
**Important:** By default, only the selected assignee and team will have access to the ticket. This helps ensure tickets are only visible to the people responsible for managing them.
{% endhint %}

#### <mark style="color:$primary;">Customer Contact</mark>

The **Customer Contact** is the primary person the ticket relates to within the requesting tenancy.

This contact is used to:

* Identify who raised or is affected by the issue.
* Associate the ticket with a specific customer user.
* Provide context for communication and ownership.

Selecting a customer contact does **not** automatically grant them access to the ticket. Access is controlled separately through customer groups and permissions.

***

#### <mark style="color:$primary;">Customer Group</mark>

A **Customer Group** allows you to grant visibility of the ticket to multiple customer users at once.

Use a customer group when:

* Multiple people from the customer organisation need visibility.
* The issue affects a department, site, or wider team.
* You want a predefined group of users to receive updates and access.

If no customer group is selected, only users with direct permission to the ticket will be able to view it.

**Example**

A ticket relating to a phishing incident could have:

* **Customer Contact:** John Smith (CTO)
* **Customer Group:** Admin

In this scenario, the Admin group can access the ticket rather than only John Smith.

***

#### <mark style="color:$primary;">Assignee</mark>

The **Assignee** is the person responsible for managing and progressing the ticket.

The assignee can:

* View the ticket.
* Update ticket details.
* Add notes and comments.
* Change status.
* Manage ticket progress.

Only one user can be the primary assignee at a time.

If a ticket is unassigned, responsibility remains with the assigned team until an individual takes ownership.

***

#### <mark style="color:$primary;">Team</mark>

The **Team** determines which internal team has access to the ticket.

Examples may include:

* Support
* SOC
* Product
* Professional Services

Users who belong to the assigned team can:

* View the ticket.
* Collaborate on the ticket.
* Reassign ownership if required.
* Assist with investigation and resolution.

Using teams ensures work can continue even when an individual assignee is unavailable.

***

### <mark style="color:$primary;">How Access Works</mark>

Ticket visibility is determined by the combination of:

| Field            | Grants Access                                      |
| ---------------- | -------------------------------------------------- |
| Customer Contact | Associates the ticket with a customer user         |
| Customer Group   | Gives visibility to selected customer users/groups |
| Assignee         | Gives ownership and access to the selected user    |
| Team             | Gives access to members of the selected team       |

#### <mark style="color:$primary;">Typical Workflow</mark>

1. Create the ticket.
2. Select the affected **Customer Contact**.
3. Optionally select a **Customer Group** if multiple customer users require visibility.
4. Assign the ticket to a specific **Assignee**.
5. Select the responsible **Team**.
6. Create the ticket.

The ticket will then be visible to the assigned user, members of the selected team, and any customer users granted access through the configured contact and group settings.

***

### <mark style="color:$primary;">Best Practice</mark>

* Use **Customer Contact** for the main point of contact.
* Use **Customer Groups** when multiple customer users need visibility.
* Always assign a **Team** so responsibility remains clear.
* Assign an **Assignee** once a specific person is taking ownership.
* Review access settings carefully before creating sensitive tickets to ensure the correct people can view and manage them.

This keeps ticket ownership clear while ensuring the right internal teams and customer stakeholders have visibility when required.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.cybaops.com/modules/detect-and-respond-mdr/ticket-creation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.