Using the Ticket Log

The Ticket Log in Coro provides a record of all tickets generated in the current workspace. These tickets are detailed records of all detected suspicious events or a series of suspicious events.

To learn more about how Coro creates and uses tickets, see Tickets in Coro.

View the Ticket Log by signing in to the Coro console and selecting Lists > Ticket Log in the sidebar:

Accessing the ticket log

note

The Tickets link in the toolbar shows all tickets in the system and provides an overview of the current ticket queue. To view tickets for a specific module, or of a specific type, use the ticket links provided in each detailed dashboard panel in the Actionboard. To learn more, see The Actionboard.

Coro raises tickets for all protected users, and also for protectable users. Protectable users are those user accounts that Coro is able to identify from your connected cloud applications, but that have not been explicitly added for protection. Tickets raised for protectable users are done so as information-only without any remediation options, in order to highlight events to admin users to inform how protection might be extended or reconfigured. Such tickets are automatically closed upon being raised.

The Ticket Log contains the following features:

The Ticket Log

The left pane shows a summary of the ticket queue, based on the selected filters. Indicators against each ticket in the queue identify if the ticket is:

Closed
For a protectable user

Select a ticket to see details in the right pane.

Coro provides the following for each ticket:

Information describing the ticket. For example, the user affected, the date the ticket was opened, the file name and size, and more.
Further ticket details, findings, and a summary of recent activity that has been performed for this ticket. To view a complete list of all activity relating to the ticket, select the All Activity link.
A Comments section, enabling an admin user to record specific comments and notes regarding the event against a ticket. To learn more, see Create a ticket comment .
An Actions button that provides relevant actions for the ticket. For more information, see Actions .

Above the ticket summary list, you can choose to display all tickets, only open tickets, or only closed tickets. You can also filter the Ticket Log using the drop-down selectors to the right.

Choose filters for:

Security module : The main component of protection as provided in the Actionboard. For example, Cloud Security. Select Everywhere for all security modules.
Type : A dynamic list of ticket types relevant to the selected module.
During : A selected time period for the Ticket Log. Choose from a number of preset periods, or specify a date range by using the calendar.

You can also search the Ticket Log using free text.

Adding comments to tickets

Admin users can add comments to tickets for any reason. Comments can contain general information, observations concerning ticket findings, or for analysis and recommended actions when communicating with other admin users, or Coro support and SOC teams.

Comments in tickets can increase the efficiency of ticket resolution by eliminating the need to manually communicate ticket-related information via email or other messaging platforms.

Creating a ticket comment

To create a ticket comment:

Sign in to the Coro console and navigate to the Ticket Log .
Select the ticket.
In the Comments area on the right-hand side of the screen, select the Comment field.
Enter your comment into the Comment field.
Select Notify and then select the recipients of the notification.
- Notify affected users - select this to notify the ticket recipient.
- Notify all workspace admins - select this to notify all the admin users for the workspace.
- Notify custom recipients - select this to notify named recipients. In the Recipient field enter a valid email address. If you enter more than one recipient, use a manual line break to separate them.
Select Comment .
The comment appears in the Comments section:

note

You cannot edit or delete a saved comment. Only the comments for highlighted or selected tickets appear on the screen.

Actions

All tickets in Coro include actions that you can perform. These actions vary by ticket type and status, and are available from the ACTIONS button at the top-right of the ticket details pane. For example, a ticket of type "Suspicious Content" shows the following actions:

The following table describes the outcome for each action on a "Suspicious Content" ticket:

Action	Outcomes
Close ticket	(Open tickets only) Close the ticket as considered remediated and take no further action.
Re-open	(Closed tickets only) Reopen this ticket for admin user intervention and manual remediation.
Contact user	Coro sends an email to the recipient containing a message and, optionally, the ticket details. Coro adds a record of the action to the ticket and the activity log.
Download Eml File	Downloads the suspicious email (in .eml format) to your local workstation for evaluation. This enables you to thoroughly examine potentially malicious emails before taking any further action. For further information, see Downloading suspicious emails for further inspection.
Allow	Coro presents a dialog enabling you to allow the suspicious email (return it from the quarantine folder back to the original recipients) and optionally add the sender's email address, domain, or IP address to the workspace allowlist. NOTE: If your Phishing security mode is set to Warn recipients, the email is already delivered so Allow is limited to adding the sender to the allowlist.
Block	Coro presents a dialog enabling you to permanently delete the suspicious email, and optionally add the sender's email address, domain, or IP address to the workspace blocklist. NOTE: If your Phishing security mode is set to Warn recipients, the email is already delivered so Block is limited to adding the sender to the workspace blocklist.

Notes

Actions vary depending on type and status of the ticket. For example, an open ticket of a particular type might contain more available actions than a ticket that has been closed.
When a device is removed from protection, all open tickets associated with the device are automatically closed.
Tickets raised for protectable users are automatically closed and have no remediation actions available.
To perform actions against multiple tickets simultaneously, use the selection checkboxes in the ticket list pane. For more details, see Bulk ticket operations .
To download a list of tickets, use the multiple ticket action Export CSV . For more details, see Exporting tickets as a CSV file .
Some ticket types provide an UNDO option for actions undertaken on one or more tickets. For more details, see Undoing actions .

To learn more about the actions for each ticket type, see:

Bulk ticket operations

To perform actions against multiple tickets simultaneously, use the checkboxes in the ticket list:

Actions for the Ticket Log

Select and deselect tickets individually, or use the checkbox at the top to select all tickets in the current list.

When you select tickets through this method, Coro displays an additional ACTIONS button above the ticket list. The available actions reflect what is applicable to the list you selected:

Actions for the Ticket Log

To close multiple open tickets without remediation, go to the Open tickets list. Select the checkboxes for all tickets you want to close, then select ACTIONS > Close tickets.

Important

Make sure you have first reviewed all tickets that you intend to close.

Apply the same process if you want to reopen multiple closed tickets. Go to the Closed tickets list and select each closed ticket you want to reopen. Then, select ACTIONS > Reopen tickets. Coro reopens all selected tickets.

Exporting tickets as a CSV file

Coro enables you to export one or more selected tickets to set of a comma-separated value (CSV) files.

Use the checkboxes to select all required tickets for the export. Then, from the top-left ACTIONS button, select Export CSV:

Exporting a CSV file of selected tickets

Coro shows a message confirming that the export is in progress and will be available at the Activity Log page later.

The download is packaged as a ZIP archive containing folders representing the protection components your selected tickets fall under. For example, Cloud Security, Email Security, and so on. Each folder contains a collection of CSV files, one per ticket type, containing all relevant tickets.

Each CSV file has the following fields:

Date: The date when the Ticket Log record was created
Admin: The user who performed the activity
Event: The Ticket Log record message

note

Ticket log CSV exports are limited to the last 90 days.

Undoing actions

Coro provides the ability to reverse, or undo, certain ticket actions through the console. This functionality is not available for all actions and applies only where an action supports reversal.

For example, Cloud Security and User Data Governance tickets include actions to suspend a user's access to their account on one or all connected cloud applications. To reverse the suspension and reinstate the user's access, use the UNDO function in the ticket where the suspension was enacted.

Perform the following steps:

Locate the ticket in which the user was suspended. If you know only the user's identity, search for them in the Protected users list. Then, use their Open tickets or Activity log lists to find the relevant ticket.
In the ticket details pane, go to the Activity log .
Find the log entry connected to the suspension.
Select UNDO :
The user's access to the cloud application is restored, and the activity log in the ticket is updated accordingly: