---
title: "Creating Tickets for Failed Posture Checks"
slug: "creating-tickets-for-failed-posture-checks"
updated: 2026-11-02T10:50:30Z
published: 2026-11-02T10:50:30Z
canonical: "knowledge.catonetworks.com/creating-tickets-for-failed-posture-checks"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.catonetworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating Tickets for Failed Posture Checks

## Overview

To track failed checks and manage remediation using existing workflows, create a ticket in your ticketing platform directly from failed [SaaS Security Posture](/v1/docs/reviewing-the-security-posture-of-your-saas-applications) or [account Posture](/v1/docs/reviewing-posture-checks-for-your-account) checks in the Cato Management Application (CMA). The ticket includes the information needed to begin remediation without manually copying details. This streamlines communication between teams using the CMA and ticketing platforms.

After you create a ticket, its ID appears in the Posture Check review drawer in the CMA.

Tickets are created using a webhook integration with a predefined template. You only need to configure the integration once. After configuration, you can use the integration to create tickets.

### Understanding the Ticket Content

When a ticket is created from the CMA, the name of the check is used as the ticket title. The ticket description includes:

- The check name, description, status, and severity
- Your Cato account name and account ID
- The recommended actions for the check
- The affected findings and the total number of findings
- A link to the check in the Cato Management Application

### Supported Ticketing Platforms

The following ticketing platforms are supported:

- Jira
- ServiceNow

## Creating Webhook Integrations

To configure the webhook integration, you need to:

1. Configure the required settings in the ticketing system
2. Configure the webhook in the CMA

#### Creating the Webhook Integration for Jira

#### Prerequisites

- User with **Browse spaces** and **Create work items** permissions

#### Step 1: Configuring the Required Settings in Jira

**To configure the settings in Jira:**

1. In your Atlassian account, click on your profile in the top right corner and click **Account settings**.
2. On the **Security** tab, in the **API tokens** section, click **Create and manage API tokens**.
3. You can create an API token either with or without scopes:
  1. To create an API token with scopes:
    1. Click **Create API token with scopes**.
    2. Add a **Name** and expiry date. **Note:** We recommend selecting the maximum expiry date of 365 days.
    3. Click **Next** and select the Jira app
    4. Click **Next** and select the **write:jira-work** scope
    5. Click **Create**.
  2. To create an API token without scopes:
    1. Click **Create API token**.
    2. Add a **Name** and expiry date. **Note:** We recommend selecting the maximum expiry date of 365 days.
    3. Click **Create**.
4. Copy and save the token so it can be entered into the CMA.
5. In your Atlassian account, on the side bar, click the three dots next to **Spaces**.
6. Click **Manage spaces.**
7. Copy and save the **Key** of the space where you want the tickets to be created so it can be entered into the CMA.
8. If you created a token with scopes, in a web browser, enter [https://<your-site>.atlassian.net/_edge/tenant_info](https://&lt;your-site&gt;.atlassian.net/_edge/tenant_info) and copy the **cloudId** value so it can be entered into the CMA. If you did not create a token with a scope, this step is not necessary.

#### Step 2: Configuring the Webhook in the CMA

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/image(238).png?sv=2026-02-06&spr=https&st=2026-11-10T16%3A49%3A48Z&se=2026-11-10T17%3A49%3A48Z&sr=c&sp=r&sig=O%2F4utIBF9VpqRTYJUwxOpRuVcQF93CU0vAHR29koGR4%3D)

**To configure the webhook in the CMA:**

1. In the CMA, navigate to **Account > Subscriptions**.
2. On the **Webhooks** tab, click **New**.
3. Add a **Name**.
4. From the **Start from template** drop-down menu, select **Jira Create Posture Check Ticket**.
5. In the **URL** field:
  1. For an API token with scopes: [https://api.atlassian.com/ex/jira/<cloudId>/rest/api/2/issue](https://api.atlassian.com/ex/jira/&lt;cloudId&gt;/rest/api/2/issue), where <cloudId> is the **cloudId** that you copied in Step 1.
  2. For an API token without scopes: [https://<your-site>.atlassian.net/rest/api/2/issue](https://&lt;your-site&gt;.atlassian.net/rest/api/2/issue), where <your-site> is the name of your Jira site.
6. Add the **User Name** of the user that created the API token in step 1.
7. In the **Password** field, enter the API key you created in step 1.
8. In the Custom Body section, replace <YOUR-SPACE-KEY> with the space key that you copied in Step 1.
9. (Optional) If your space does not use the **Task** work type, or requires additional fields for new work items, edit the body accordingly.
10. Click **Test**. A test work item is created in the Jira space, and the message Test passed successfully is shown. You can delete the test work item afterwards.
11. Click **Save**.

#### Creating the Webhook Integration for ServiceNow

#### Prerequisites

- User with the **itil** role

#### Step 1: Configuring the Required Settings in ServiceNow

**To configure the settings in ServiceNow:**

1. Log in to your ServiceNow account as an administrator and navigate to **User Administration > Users**.
2. Click **New**.
3. Enter a **User ID** and **email address** and select **Web service access only**.
4. Click **Submit**.
5. Open the record of the user you created:
  1. Click **Set Password** then **Generate Password**. Copy and save the password so it can be entered into the CMA.
  2. Click **Save Password**.
  3. On the **Roles** tab, click **Edit** and add the **itil** role
  4. Click **Save**

#### Step 2: Configuring the Webhook in the CMA

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/image(239).png?sv=2026-02-06&spr=https&st=2026-11-10T16%3A49%3A48Z&se=2026-11-10T17%3A49%3A48Z&sr=c&sp=r&sig=O%2F4utIBF9VpqRTYJUwxOpRuVcQF93CU0vAHR29koGR4%3D)

**To configure the webhook in the CMA:**

1. In the CMA, navigate to **Account > Subscriptions**.
2. On the **Webhooks** tab, click **New**.
3. Add a **Name**.
4. From the **Start from template** drop-down menu, select **ServiceNow Create Posture Check Ticket**.
5. In the **URL** field, replace <YOUR-INSTANCE-NAME> with your ServiceNow instance name, so that the URL is [h](http://service-now.com/api/now/table/incident)[ttps://<instance>.service-now.com/api/now/table/incident.](https://&lt;instance&gt;.service-now.com/api/now/table/incident.)

Your instance name is the first part of your ServiceNow URL. For example, if you log in to [https://acme.service-now.com](https://acme.service-now.com), the instance name is acme, and the URL is [https://acme.service-now.com/api/now/table/incident](https://acme.service-now.com/api/now/table/incident).
6. In the **User Name** field, enter the User ID of the ServiceNow user you created in Step 1.
7. In the **Password** field, enter the password of the ServiceNow user you created in Step 1.
8. (Optional) In the **Custom Body** section, change the default **priority**, **urgency** and **impact** of the incidents, or add fields such as **assignment_group.**
9. Click **Test**. A test incident is created in the ServiceNow, and the message Test passed successfully is shown. You can resolve or close the test work item afterwards.
10. Click **Save**.

## Creating a Ticket For a Failed Posture Check

After you create a webhook integration, you can create a ticket from the **Posture Check Review** drawer in the CMA. The ticket includes up to 100 findings with basic details. If the check contains more than 100 findings, or to include full details, select the **Add a link to the full findings list (CSV)** check box and download the complete findings as a CSV file. To include the CSV in the ticket, upload it to a shared location, such as SharePoint, and add the shareable link in the CMA.

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/image(258).png?sv=2026-02-06&spr=https&st=2026-11-10T16%3A49%3A48Z&se=2026-11-10T17%3A49%3A48Z&sr=c&sp=r&sig=O%2F4utIBF9VpqRTYJUwxOpRuVcQF93CU0vAHR29koGR4%3D)

**To create a ticket for a failed posture check:**

1. In the CMA, navigate to **Home > Posture**.
2. Click on the failed check you want to create a ticket for.
3. Click **Create Ticket**.
4. In the **Integration** drop-down, select the webhook integration to use to create a ticket.
5. (Optional) If the check has more than 100 findings, you can download a CSV file add the link to a shared location.
6. Click **Create Ticket**.

## Viewing Created Tickets

Once a ticket is created from the CMA, the ID the ticket is displayed in the **Posture Check Review** drawer of the check.

**Note:** Tickets are not automatically updated once a posture check is passed.

![](https://cdn.document360.io/81d0367c-2b69-4ba8-b412-1c8f46ce677e/Images/Documentation/image(241).png?sv=2026-02-06&spr=https&st=2026-11-10T16%3A49%3A48Z&se=2026-11-10T17%3A49%3A48Z&sr=c&sp=r&sig=O%2F4utIBF9VpqRTYJUwxOpRuVcQF93CU0vAHR29koGR4%3D)

### Troubleshooting

If ticket creation fails, the error message shows the status returned by the ticketing system:

- **401 (Unauthorized):** The credentials are incorrect, or the token has expired. Check the webhook’s **User Name** and **Password** fields, then click **Test**. For Jira, use the user’s email address and API token. If the token has expired, create a new token and update the webhook’s **Password** field.
- **403 (Forbidden):** The user does not have the required permissions. For Jira, verify that the user has **Browse spaces** and **Create work items** permissions in the relevant space. For ServiceNow, verify that the user has the **itil** role.
- **400 (Bad Request):** The ticketing system rejected the request body. Check for an incorrect space key or a missing required field in the **Custom Body**.
- **Ticket ID missing:** The ticket was created, but Cato could not read its ID from the response. Verify that the webhook’s response mapping matches the template.