Ticketing

Ctadel creates a ticket in your tracking tool from a finding, then follows the state of that ticket. This page describes the six supported systems, the creation of a ticket and the guard that protects the network of your instance.

Configuring an integration

Open "Settings", tab "Integrations", sub-tab "Ticketing". The "Ticketing Integrations" card shows six systems: Jira Cloud, Linear, GitHub Issues, GitLab Issues, ServiceNow and YouTrack. GitLab Issues and YouTrack carry the "EU" badge. One integration per system: once connected, the tile shows "Connected" and the actions move to its row in the "Active Integrations" list. Reading requires read:settings, changing requires update:settings.

The "Connect {name}" form asks for an "Integration Name" and then the fields of the system.

System	Fields
Jira Cloud	"Jira URL", "Jira Email", "API Token", "Project Key", "Issue Type" (optional; "Bug" otherwise)
Linear	"API Key", "Team ID"
GitHub Issues	"Personal Access Token", "Owner", "Repository"
GitLab Issues	"GitLab URL" (optional; gitlab.com otherwise), "Personal Access Token", "Project ID"
ServiceNow	"Instance URL", "Integration user (Basic auth, never expires)" (optional), "Password of the integration user, or an OAuth access token (expires, 30 min by default)", "Table" (optional)
YouTrack	"YouTrack URL", "Permanent Token", "Project ID"

The "Test" button checks the required fields and the shape of the address, then calls the system with your credentials (the current profile on Jira, Linear and GitLab, the repository on GitHub, the table on ServiceNow, the project on YouTrack); it answers "Connection successful" or the returned error. "Connect" stores the configuration, encrypted, in your instance; it is never sent back to the browser.

To rotate a token, open "Edit {name}": "Leave the credential fields empty to keep the stored configuration, or fill in every required field to replace it (for example after rotating a token)." A replaced configuration goes through the same checks as a new one. Each integration can also be disabled (no call leaves for it any more) or deleted: "This will also delete all linked tickets. Continue?"

Creating a ticket from a finding

In the detail panel of a finding, the button with the ticket icon opens "Create Ticket" ("Create a ticket in your external ticketing system for this finding."). The action requires the update:issues permission.

1. Choose the "Integration" among the enabled ones.
2. Review the "Title", prefilled as [SEVERITY] rule name, resource identifier, and the "Description", prefilled with the rule, the type, the rule key, the resource and the severity.
3. Click "Create Ticket". The message "Ticket created successfully" shows the ticket identifier with a link to your tool.

Tickets already open for this finding appear under "Existing Tickets", with their state and identifier; the panel button carries their count. A finding has one ticket per integration: a second creation on the same integration is refused, including when two people click at the same time. Without an enabled integration, the dialog shows "No ticketing integrations configured." and points to the settings.

What Ctadel sends

System	Ticket fields
Jira Cloud	Summary and description, the configured issue type, priority by severity, labels ctadel and the finding type
Linear	Title, description, priority by severity
GitHub Issues	Title, body, labels ctadel, the severity and the finding type
GitLab Issues	Title, description, labels ctadel, the severity and the finding type
ServiceNow	Short description, description, urgency by severity, category Security, in the configured table
YouTrack	Summary and description, in the configured project

Priority follows severity: CRITICAL gives 1, HIGH 2, MEDIUM 3, LOW 4. The title and description are those of the dialog, which you can edit before sending.

State tracking

Every 5 minutes, the instance re-reads the state of open tickets and of those closed less than 30 days ago, integration by integration. A ticket your tool considers finished (for example a "done" status category on Jira) turns closed in Ctadel; a ticket reopened on your side is reopened here. The tool's native state is kept alongside. A disabled integration is not queried.

Guard against internal addresses

The addresses typed in the forms are the ones the instance will call. So that an integration cannot be used to reach the internal network of the instance, every call applies these rules:

• The address must start with https:// and be limited to a host and a path: no credentials, no query parameters.
• localhost, names without a dot, .local names and any non-public IP address are refused: private networks, loopback, link-local, reserved and test ranges, carrier-grade NAT.
• The check applies to the address obtained after DNS resolution: a public name that resolves, even partly, to a private address is refused.
• Redirects are followed five times at most, only to https://.

The message on refusal: "the address is not a public one; Ctadel only reaches ticketing systems on the internet".

Limitations

• One integration per system; one ticket per finding and per integration.
• Jira is supported through the Jira Cloud API (authentication by email address and API token); Jira Server or Data Center is not covered.
• A self-hosted tool must be reachable on a public address over HTTPS; no option of the interface lifts this rule.
• Closing a ticket does not resolve the finding, and resolving a finding does not close the ticket; no comment is synchronised.
• Linear receives no label, only the priority.
• No page lists every created ticket; they are viewed finding by finding.
• Ticket states are re-read every 5 minutes; there is no refresh button in the interface.