Using the ticket log¶

The ticket log in Coro provides a record of all tickets generated in the current workspace. These tickets are detailed records of all detected suspicious events or a series of suspicious events.

To learn more about how Coro creates and uses tickets, see Tickets in Coro.

View the ticket log by logging into the Coro console and selecting the ticket log icon in the toolbar:

Coro raises tickets for all protected users, and also for protectable users. Protectable users are those user accounts that Coro is able to identify from your connected cloud applications, but that have not been explicitly added for protection. Tickets raised for protectable users are done so as information-only without any remediation options, in order to highlight events to Admin users to inform how protection might be extended or reconfigured. Such tickets are automatically closed upon being raised.

The ticket log contains the following features:

The left pane shows a summary of the ticket queue, based on the selected filters. Select a ticket to see details in the right pane.

Coro provides the following for each ticket:

• Information describing the ticket. For example, the user affected, the date the ticket was opened, the file name and size, and more.

• Further ticket details, findings, and a summary of recent activity that has been performed for this ticket. To view a complete list of all activity relating to the ticket, select the All Activity link.

• A Comments section, enabling an Admin user to record specific comments and notes regarding the event against a ticket. To learn more, see Create a ticket comment.

• An Actions button that provides relevant actions for the ticket.

  For example, a ticket of type "Suspicious Content" shows the following actions:

  

  Action	Outcomes
  Re-open	Reopen this ticket for Admin user intervention and manual remediation.
  Contact user	Coro sends an email to the recipient containing a message and the ticket info. An action: "Contact User" is recorded in the Ticket Log and Activity log.
  Download Eml File	Download the suspicious email (.eml format). This allows you to thoroughly examine potentially malicious emails before taking any further action. For further information, see Downloading suspicious emails for further inspection.
  Allow	Coro presents a dialog offering you the choice of either allowing this email (return it from the quarantine folder back to the original recipients), or allowing this email and optionally adding the sender's email address or domain to the workspace allowlist.
  Block	Coro presents a dialog offering you the choice of either Permanently deleting this email, or deleting the email and optionally adding the sender's email address or domain to the workspace blocklist.

  Note

  Actions might vary depending on type and status of the ticket. For example, an open ticket of a particular type might contain more available actions than a ticket that has been closed.

  Note

  When a device is removed from protection, all open tickets associated with the device are automatically closed.

  Note

  Tickets raised for protectable users are automatically closed and have no remediation Actions available.

  To learn more about the actions for each ticket type, see:

  • Endpoint Security
  • Cloud Security
  • Email Security
  • User Data Governance
  • Endpoint Data Governance
  • EDR

Above the ticket summary list, you can choose to display all tickets, only open tickets, or only closed tickets. You can also filter the Ticket Log using the drop-down selectors to the right.

Choose filters for:

• Security module: The main component of protection as provided in the Actionboard. For example, Cloud Security. (select Everywhere for all security modules)
• Type: A dynamic list of ticket types relevant to the selected module.
• During: A selected time period for the ticket log. Choose from a number of preset periods, or specify a date range by using the calendar.

You can also search the ticket log using free text.

Adding comments to tickets¶

Comments can be added to tickets. This is advantageous for both Coro customers and Coro SOC team members when communicating ticket analysis and recommended actions. Comments can also provide general information.

Comments in tickets can increase the efficiency of ticket resolution by eliminating the need to manually communicate ticket-related information via email or other messaging platforms.

In addition, customers will be able to respond to SOC's analysis and add their own general notes to tickets. Comments can also be sent to customers directly from the Coro console.

Creating a ticket comment¶

To create a ticket comment:

1. Log into the Coro console and navigate to the Ticket Log.
2. Select the ticket to which you would like to add a comment.

3. Select the Comments icon, located next to the Actions button:

   

   The Comments section is displayed:

   

4. Select +.

   The New comment dialog is displayed:

   

5. Enter your comment into the Comment field.

   Note

   There is no limit to the total number of characters in comments.

   Note

   Comments must contain at least one character in order to be saved.

6. Select ADD.

   

   The comment is saved and displayed under the Comments section:

   

   Note

   Saved comments cannot be edited or deleted.

Emailing a ticket comment¶

Ticket comments can be emailed in order to notify the following recipients:

• Affected users: Emails the ticket comment to the ticket recipient.
• All workspace admins: Emails the ticket comment to all workspace admins
• Custom recipients: Emails the ticket comment to one or more specified email addresses.

To email a ticket comment:

1. Create a new ticket comment.

2. Expand the Email Comment dropdown:

   

   The email notification options are displayed:

   

3. Select one or multiple notification options:

   

4. Select ADD.

   The ticket comment is saved and the selected recipients are notified via email.

   Confirmation is displayed under the Comments section:

   

   The email notification recipient(s) can view the ticket comment from their inbox:

   

   The email notification recipient(s) can click the link within the email to navigate to the corresponding ticket in the Ticket Log:

   

Closing or reopening multiple tickets together¶

To close multiple open tickets at once without remediation, use the checkboxes adjacent to each ticket in the summary pane.

Use the checkboxes to select or deselect each ticket you want to close. Or, to select all tickets in the current view, use the checkbox at the top of the list.

When one or more tickets are selected, Coro displays a dedicated Actions menu button at the top of the pane. To close all currently selected tickets without any further remediation, select Actions > Close tickets.

Apply the same process if you want to reopen multiple closed tickets. Go to the Closed tickets list and select or deselect each closed ticket you want to reopen. Then, select Actions > Reopen tickets. Coro places each selected ticket back into an open state.