> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/notifications/platform-setup/ticketing-system-setup-for-organization-notifications.md). # Ticketing System Setup for Organization Notifications When you connect Workbench to a ticketing system, you can send organization-level notifications to that ticketing system to track and manage, just like you do other tickets in your environment. This guide is the first step of a larger process to enable organization notifications. {% hint style="info" %} After completing the steps on this page, you will be instructed to go to [Manage Organization Notifications](/workbench-setup/notifications/manage-organization-notifications.md) to set up your actual notifications. {% endhint %} ## Supported Ticketing Systems You can connect the following ticketing systems to Workbench: * Asana * Jira * Request Tracker for Incident Response * Splunk On-Call * Striven ## Prerequisites 1. You must have a destination email address for your ticketing system before you begin. * This is the email that will receive and process the notifications from Workbench and route them to your ticketing system. 2. You must be an organization admin to integrate a ticketing system with Workbench. ## Step 1: Add a Ticketing System in Workbench {% hint style="info" %} Make sure you have the destination email address for your ticketing system before you begin these steps. {% endhint %} 1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F). 2. Select **Organization Settings > My Organization**. * If you have multiple organizations, you must also select the appropriate organization name from the list. 3. Scroll down and select the **Integrations** tab. 4. Under **Email Ticketing Systems**, select **Add a ticketing destination**. 5. Enter the name of your ticketing system (you might enter "Jira", "Asana", etc.) and the email address to receive the ticket information from Workbench. 6. Select **Add**. 7. Look for an **Enabled** banner. 8. Now, select the **Test connection** link to test the connection.
Image showing the enabled banner and the link to test the connection.
9. Check the receiving email and its ticketing system destination to be sure the test worked. 10. Repeat this process to add any other ticketing systems you wish to integrate. ## Step 2: Add Your Organization Notifications Now you can begin setting up your organization notifications. See [Manage Organization Notifications](/workbench-setup/notifications/manage-organization-notifications.md) for instructions. {% hint style="info" %} For a list of default notifications, see [Default Organization Notifications](/workbench-setup/notifications/about-notifications.md#default-organization-notifications). You can edit these notifications at any time using the instructions in the linked guide above. {% endhint %} ## Ticketing Template Reference All email ticketing notifications are delivered in plain text format and are sent from the Expel SOC (). The HTML and Handlebars structures of the most common notifications are outlined below, should you need to understand how to parse and trigger automated ticketing workflows based on these notifications. If a particular notification format is not shown here, please [contact support](/support/how-to-reach-us.md) for further assistance. ### Expel Alert Opened ``` A {{current.expel_severity_display}} {{#if (condition current.alert_type "==" "ALERT_TYPE_PHISHING_SUBMISSION")}} phishing {{/if}} alert was identified in your environment.

{{current.expel_name}}
Expel alert ID: {{current.id}}
{{meta.wb_url}}/activity/alerts/{{current.id}}

NEXT STEPS
- No action required right now.
- Stay alert for additional notifications, since the status of the alert may change and we may recommend more next steps as the scope becomes clear.

ALERT DETAILS
{{#if (condition current.alert_type "==" "ALERT_TYPE_HUNTING")}} Expel alert: {{current.expel_name}}
Expel alert time: {{current.expel_alert_time}} {{else if (condition current.alert_type "!=" "ALERT_TYPE_PHISHING_SUBMISSION")}} Vendor: {{vendor.name}}
{{/if}} {{#if (condition current.alert_type "!=" "ALERT_TYPE_HUNTING")}} Vendor alert time: {{current.expel_alert_time}} {{/if}} ``` ### Expel Alert Closed ``` {{#if (condition current.alert_type "==" "ALERT_TYPE_PHISHING_SUBMISSION")}} A phishing {{else}} An {{/if}} alert was closed in your environment: {{current.close_reason_display}}.

{{current.expel_name}}
Expel alert ID: {{current.id}}
{{meta.wb_url}}/activity/alerts/{{current.id}}

CLOSED REASON
{{current.close_reason_display}}

{{#if (condition current.alert_type "==" "ALERT_TYPE_HUNTING")}} Expel alert: {{current.expel_name}}
Expel alert time: {{current.expel_alert_time}} {{else if (condition current.alert_type "!=" "ALERT_TYPE_PHISHING_SUBMISSION")}} Vendor: {{vendor.name}}
{{/if}} {{#if (condition current.alert_type "!=" "ALERT_TYPE_HUNTING")}} Vendor alert time: {{current.expel_alert_time}} {{/if}} ``` ### Investigation Opened ``` An investigation was kicked off in your environment.

{{current.title}}

{{#if meta.is_detect_only}} Next Steps
{{current.next_steps}} {{else}} Next Steps
- Check Workbench for more details. We'll provide more details shortly.
- Watch for remediation actions. {{/if}}

{{#if meta.is_detect_only}} SUMMARY
{{current.open_summary}}

{{else if current.summary}} SUMMARY
{{current.summary}}

{{/if}} {{#unless current.lead_expel_alert_id }} INITIAL LEAD
Organization reported {{else}} INITIAL LEAD
Detection: {{current.detection_type_display}}
Expel alert name: {{lead_expel_alert.expel_name}}
Expel alert ID: {{lead_expel_alert.id}}
Expel alert time: {{lead_expel_alert.created_at}} {{/unless}}

DETAILS
Created by: {{created_by_user_account.display_name}} ``` ### Investigation Closed ``` We closed an investigation: {{current.decision_display}}

{{current.title}}

Next Steps
• No action required right now.
• If you have questions about this investigation, please contact the SOC or your engagement manager.

CLOSE REASON
{{current.decision_display}}

{{#unless current.lead_expel_alert_id }} INITIAL LEAD
Organization reported {{else}} INITIAL LEAD
Detection: {{current.detection_type_display}}
Expel alert name: {{lead_expel_alert.expel_name}}
Expel alert ID: {{lead_expel_alert.id}}
Expel alert time: {{lead_expel_alert.created_at}} {{/unless}}

DETAILS
Closed by: {{updated_by_user_account.display_name}} ``` ### Verify Action Assigned ``` A verify action was assigned to your organization.

{{#if investigation}} {{investigation.title}} {{else}} Expel Alert {{/if}}

Next Steps
- Verify Activity (see below).
- Log into Workbench to report the outcome of this investigative action.

VERIFY ACTIVITY

{{#markdown}}{{current.instructions}}{{/markdown}}

DETAILS

{{#markdown}}{{current.reason}}{{/markdown}}

Created by: {{created_by_actor.display_name}}

When you're done, please log into the Expel Workbench to complete the action.

{{#unless investigation.lead_expel_alert_id }} INITIAL LEAD
Organization reported {{else}} INITIAL LEAD
Expel alert name: {{lead_expel_alert.expel_name}}
Expel alert ID: {{lead_expel_alert.id}}
Expel alert time: {{lead_expel_alert.created_at}} {{/unless}}

``` ### Incident Opened ``` {{#if (condition current.analyst_severity "==" "ANALYST_SEVERITY_CRITICAL")}} A critical {{current.threat_type_display}} incident has been identified in your environment. {{else}} {{#if current.threat_type_display}}A{{else}}An{{/if}} {{current.threat_type_display}} incident has been identified in your environment. {{/if}}

{{current.title}}

{{#if meta.is_detect_only}} Next Steps
{{current.next_steps}} {{else}} Next Steps
- Check Workbench for more details. We'll provide more details shortly.
- Watch for remediation actions. {{/if}}

{{#if meta.is_detect_only}} SUMMARY
{{current.open_summary}}

{{else if current.summary}} SUMMARY
{{current.summary}}

{{/if}} {{#unless current.lead_expel_alert_id }} INITIAL LEAD
Organization reported {{else}} INITIAL LEAD
Detection: {{current.detection_type_display}}
Expel alert name: {{lead_expel_alert.expel_name}}
Expel alert ID: {{lead_expel_alert.id}}
Expel alert time: {{lead_expel_alert.created_at}} {{/unless}}

DETAILS
Created by: {{created_by_user_account.display_name}} ``` ### Incident Closed ``` {{#if (condition current.analyst_severity "==" "ANALYST_SEVERITY_CRITICAL")}} Critical {{/if}} Incident closed

{{current.title}}

NEXT STEPS
• No action required right now.
• If you have questions about this incident, please contact the SOC or your engagement manager.

{{#if meta.is_detect_only}} SUMMARY
{{current.open_summary}}

{{else if current.summary}} SUMMARY
{{current.summary}}

{{/if}} {{#unless current.lead_expel_alert_id }} INITIAL LEAD
Organization reported {{else}} INITIAL LEAD
Detection: {{current.detection_type_display}}
Expel alert name: {{lead_expel_alert.expel_name}}
Expel alert ID: {{lead_expel_alert.id}}
Expel alert time: {{lead_expel_alert.created_at}} {{/unless}}

DETAILS
Closed by: {{updated_by_user_account.display_name}} ``` ### Comment Added ``` There's a new comment on the {{#if investigation.is_incident}} incident: {{else}} investigation: {{/if}}

{{investigation.title}}

Next steps
- Acknowledge and respond, if appropriate

COMMENT
{{current.comment}}

DETAILS
Commenter: {{updated_by_actor.display_name}}
Added: {{current.created_at}}
{{#if investigation.lead_expel_alert_id}} Expel alert ID: {{investigation.lead_expel_alert_id}} {{/if}} ``` ### Remediation Action Assigned ``` {{#unless remediation_action.has_manual_fallback}}A {{#if investigation.is_critical}}critical {{/if}}remediation action was assigned to your organization - {{current.action}}{{/unless}} {{#if remediation_action.has_manual_fallback}}Expel SOC attempting manual fallback - {{current.action}}{{/if}}

{{#if (and has_failed_assets (not remediation_action.has_manual_fallback))}} Automation failed, manual remediation needed. {{/if}} {{#if remediation_action.has_manual_fallback}} Automation failed, Expel SOC attempting manual fallback. {{/if}}

{{investigation.title}}

Remediation Details:

{{#markdown}}{{current.action}}{{/markdown}}

{{#replace-all "\n" "
"}}{{detail_markdown}}{{/replace-all}}

{{#if investigation.is_incident}} Incident details:

Detection: {{investigation.detection_type}}
Incident name: {{investigation.title}}
Time detected: {{investigation.created_at}}
Workbench link: {{meta.wb_url}}/activity/investigations/{{investigation.short_link}}/findings

{{/if}} Details:

Created by: {{created_by_actor.display_name}}

{{#unless investigation.lead_expel_alert_id }} INITIAL LEAD
Organization reported {{else}} INITIAL LEAD
Expel alert name: {{lead_expel_alert.expel_name}}
Expel alert ID: {{lead_expel_alert.id}}
Expel alert time: {{lead_expel_alert.created_at}} {{/unless}}

``` ### Auto Remediation in Progress ``` Automated remediation action in progress- {{current.action}}

{{#if has_failed_assets}} Automation failed, manual remediation needed. {{/if}}

{{investigation.title}}

Remediation Details:

{{#markdown}}{{current.action}}{{/markdown}}

{{#replace-all "\n" "
"}}{{detail_markdown}}{{/replace-all}}

{{#if investigation.is_incident}} Incident details:

Detection: {{investigation.detection_type}}
Incident name: {{investigation.title}}
Time detected: {{investigation.created_at}}
Workbench link: {{meta.wb_url}}/activity/investigations/{{investigation.short_link}}/findings

{{/if}} Details:

Created by: {{created_by_actor.display_name}}

{{#unless investigation.lead_expel_alert_id }} INITIAL LEAD
Organization reported {{else}} INITIAL LEAD
Expel alert name: {{lead_expel_alert.expel_name}}
Expel alert ID: {{lead_expel_alert.id}}
Expel alert time: {{lead_expel_alert.created_at}} {{/unless}}

``` ### Remediation Completed ``` A {{#if investigation.is_critical}}critical {{/if}}remediation action for your organization was completed - {{current.action}}

{{investigation.title}}

Remediation Details:

{{#markdown}}{{current.action}}{{/markdown}}

{{#replace-all "\n" "
"}}{{detail_markdown}}{{/replace-all}}

{{#if investigation.is_incident}} Incident details:

Detection: {{investigation.detection_type}}
Incident name: {{investigation.title}}
Time detected: {{investigation.created_at}}
Workbench link: {{meta.wb_url}}/activity/investigations/{{investigation.short_link}}/findings

{{/if}} Details:

Created by: {{created_by_actor.display_name}}

{{#unless investigation.lead_expel_alert_id }} INITIAL LEAD
Organization reported {{else}} INITIAL LEAD
Expel alert name: {{lead_expel_alert.expel_name}}
Expel alert ID: {{lead_expel_alert.id}}
Expel alert time: {{lead_expel_alert.created_at}} {{/unless}}

``` ### Unhealthy Security Device ``` Security device {{current.name}} has a problem: {{security_device.problem}}

``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/workbench-setup/notifications/platform-setup/ticketing-system-setup-for-organization-notifications.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.