Using the Ticket Log

The Ticket Log in Coro provides a record of all tickets generated in the current workspace. These tickets are detailed records of all detected suspicious events or a series of suspicious events.

To learn more about how Coro creates and uses tickets, see Tickets in Coro.

View the Ticket Log by signing in to the Coro console and selecting Lists > Ticket Log in the sidebar:

Coro raises tickets for all protected users, and also for protectable users. Protectable users are those user accounts that Coro is able to identify from your connected cloud applications, but that have not been explicitly added for protection. Tickets raised for protectable users are done so as information-only without any remediation options, in order to highlight events to admin users to inform how protection might be extended or reconfigured. Such tickets are automatically closed upon being raised.

The Ticket Log contains the following features:

The left pane shows a summary of the ticket queue, based on the selected filters. Indicators against each ticket in the queue identify if the ticket is:

• Closed
• For a protectable user

Select a ticket to see details in the right pane.

Coro provides the following for each ticket:

• Information describing the ticket. For example, the user affected, the date the ticket was opened, the file name and size, and more.
• Further ticket details, findings, and a summary of recent activity that has been performed for this ticket. To view a complete list of all activity relating to the ticket, select the All Activity link.
• A Comments section, enabling an admin user to record specific comments and notes regarding the event against a ticket. To learn more, see Create a ticket comment .
• An Actions button that provides relevant actions for the ticket. For more information, see Actions .

Above the ticket summary list, you can choose to display all tickets, only open tickets, or only closed tickets. You can also filter the Ticket Log using the drop-down selectors to the right.

Choose filters for:

• Security module : The main component of protection as provided in the Actionboard. For example, Cloud Security. Select Everywhere for all security modules.
• Type : A dynamic list of ticket types relevant to the selected module.
• During : A selected time period for the Ticket Log. Choose from a number of preset periods, or specify a date range by using the calendar.

You can also search the Ticket Log using free text.

Adding comments to tickets

Admin users can add comments to tickets for any reason. Comments can contain general information, observations concerning ticket findings, or for analysis and recommended actions when communicating with other admin users, or Coro support and SOC teams.

Comments in tickets can increase the efficiency of ticket resolution by eliminating the need to manually communicate ticket-related information via email or other messaging platforms.

Creating a ticket comment

To create a ticket comment:

1. Sign in to the Coro console and navigate to the Ticket Log .
2. Select the ticket.
3. In the Comments area on the right-hand side of the screen, select the Comment field.

   

4. Enter your comment into the Comment field.
5. Select Notify and then select the recipients of the notification.
   • Notify affected users - select this to notify the ticket recipient.
   • Notify all workspace admins - select this to notify all the admin users for the workspace.
   • Notify custom recipients - select this to notify named recipients. In the Recipient field enter a valid email address. If you enter more than one recipient, use a manual line break to separate them.
6. Select Comment .

   The comment appears in the Comments section:

   

Actions

All tickets in Coro include actions that you can perform. These actions vary by ticket type and status, and are available from the ACTIONS button at the top-right of the ticket details pane. For example, a ticket of type "Suspicious Content" shows the following actions:

The following table describes the outcome for each action on a "Suspicious Content" ticket:

To learn more about the actions for each ticket type, see:

• Endpoint Security
• Cloud Security
• Email Security
• User Data Governance
• Endpoint Data Governance
• EDR

Bulk ticket operations

To perform actions against multiple tickets simultaneously, use the checkboxes in the ticket list:

Select and deselect tickets individually, or use the checkbox at the top to select all tickets in the current list.

When you select tickets through this method, Coro displays an additional ACTIONS button above the ticket list. The available actions reflect what is applicable to the list you selected:

To close multiple open tickets without remediation, go to the Open tickets list. Select the checkboxes for all tickets you want to close, then select ACTIONS > Close tickets.

Apply the same process if you want to reopen multiple closed tickets. Go to the Closed tickets list and select each closed ticket you want to reopen. Then, select ACTIONS > Reopen tickets. Coro reopens all selected tickets.

Exporting tickets as a CSV file

Coro enables you to export one or more selected tickets to set of a comma-separated value (CSV) files.

Use the checkboxes to select all required tickets for the export. Then, from the top-left ACTIONS button, select Export CSV:

Coro shows a message confirming that the export is in progress and will be available at the Activity Log page later.

The download is packaged as a ZIP archive containing folders representing the protection components your selected tickets fall under. For example, Cloud Security, Email Security, and so on. Each folder contains a collection of CSV files, one per ticket type, containing all relevant tickets.

Each CSV file has the following fields:

• Date: The date when the Ticket Log record was created
• Admin: The user who performed the activity
• Event: The Ticket Log record message

Undoing actions

Coro provides the ability to reverse, or undo, certain ticket actions through the console. This functionality is not available for all actions and applies only where an action supports reversal.

For example, Cloud Security and User Data Governance tickets include actions to suspend a user's access to their account on one or all connected cloud applications. To reverse the suspension and reinstate the user's access, use the UNDO function in the ticket where the suspension was enacted.

Perform the following steps:

1. Locate the ticket in which the user was suspended. If you know only the user's identity, search for them in the Protected users list. Then, use their Open tickets or Activity log lists to find the relevant ticket.
2. In the ticket details pane, go to the Activity log .
3. Find the log entry connected to the suspension.
4. Select UNDO :

   

5. The user's access to the cloud application is restored, and the activity log in the ticket is updated accordingly: