What is Ticketra?
Ticketra is a security operations (SOC) case management platform. It helps security teams turn raw alerts and logs into structured investigations: extract the things that matter (IPs, hashes, domains, users), enrich them with threat intelligence, track the investigation as a case, and keep a complete audit trail of who did what.
It is built for security operations teams of any size — from a solo analyst to a large, multi-analyst SOC running many concurrent investigations — and is designed to be self-hosted, multi-tenant, and air-gap compatible.
Who it's for
- Analysts investigating incidents from logs and alerts.
- Admins configuring schemas, users, roles, and integrations for a team.
- Integrators wiring Ticketra to SIEMs, threat-intel providers, and directory services.
- Operators deploying, backing up, and hardening the platform.
What makes it different
Ticketra is observable-centric. Instead of starting from raw event codes, it treats the observables in your environment — an IP address, a file hash, a username — as first-class, reusable entities. The same observable can appear across many alerts and cases, so you build institutional memory over time.
Ticketra surfaces correlations between observables and cases but never auto-links them. Correlation is presented for a human to decide on — this avoids the noise and false trails that automatic linking creates in a SOC.
What you get
| Capability | What it does |
|---|---|
| Log ingestion | Accepts security logs and extracts observables. |
| Observable registry | A reusable, searchable hive of IPs, hashes, domains, users, and more. |
| Case management | Full case lifecycle with tasks, comments, tags, attachments, and sequence steps. |
| CTI enrichment | Enrich observables via VirusTotal, AbuseIPDB, MISP, Shodan, GreyNoise, and OTX AlienVault. |
| Real-time collaboration | Live case updates and analyst presence via Server-Sent Events. |
| Audit trail | An append-only record of every significant action. |
| Multi-tenancy | Isolated workspaces, with optional cross-tenant system users. |
| Backups & restore | Scheduled, verifiable backups of the database and files. |
| Notifications | Alert delivery via email, Discord, and Microsoft Teams. |
| LDAP / AD auth | Optional directory-backed authentication with role mapping. |
How it's deployed
Ticketra runs as four Docker containers — a frontend (Nginx + React), an API (Node/Express), PostgreSQL, and OpenSearch — orchestrated with Docker Compose. There are no cloud dependencies at runtime, so it runs equally well on the internet or fully air-gapped.
Ready to try it? Head to the Quickstart.