Tickets

Tickets bridge the gap between identifying compliance issues and resolving them. When a finding is discovered, a risk needs treatment, or a control gap is identified, create a ticket to track the remediation work through completion.

Ticket Properties

Field	Description
Title	A clear, actionable description of the work
Description	Detailed context, including steps to reproduce or implement
Priority	critical, high, medium, low
Status	open, in_progress, resolved, closed
Assignee	The person or team responsible
Finding ID	Optional link to the originating finding
Due Date	Target completion date

Creating Tickets

From a Finding

When reviewing findings from a security assessment:

1. Click Create Ticket on the finding detail page
2. The ticket is automatically linked to the finding
3. Set the priority (defaulting to the finding severity)
4. Assign to the appropriate team member

From the API

curl -X POST https://api.clawgrc.com/api/v1/tickets \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{
    "title": "Remediate SQL injection in user search endpoint",
    "description": "Finding F-2024-042 identified SQL injection...",
    "priority": "high",
    "finding_id": "finding-uuid-here"
  }'

From an Agent (via MCP)

Agents can create tickets through the grc.create_ticket MCP tool:

{
  "method": "grc.create_ticket",
  "params": {
    "title": "Update TLS configuration to disable TLS 1.0",
    "description": "Automated scan detected TLS 1.0 support on api.example.com",
    "priority": "medium",
    "finding_id": "finding-uuid-here"
  }
}

Ticket Lifecycle

Priority Guidelines

Priority	Response SLA	Description
Critical	24 hours	Actively exploitable vulnerability, compliance deadline imminent
High	72 hours	Significant security gap, audit deadline approaching
Medium	14 days	Control improvement needed, no immediate risk
Low	30 days	Best practice improvement, optimization

API Endpoints

Method	Endpoint	Description
GET	/api/v1/tickets	List tickets
POST	/api/v1/tickets	Create a ticket
GET	/api/v1/tickets/:id	Get ticket details
PUT	/api/v1/tickets/:id	Update a ticket

Tips and Best Practices

• Link tickets to findings -- Always link remediation tickets to the originating finding. This creates a traceable chain from discovery to resolution that auditors expect to see.
• Set realistic SLAs -- Align ticket priorities with your organization's vulnerability management policy.
• Use agents for automated triage -- Configure agents to automatically create tickets from critical and high findings, ensuring nothing slips through the cracks.
• Close the loop -- When a ticket is resolved, verify the fix by re-running the assessment or scan that produced the original finding.