Skip to main content

The observable-centric model

Most ticketing tools are case-centric: an alert becomes a ticket, you work the ticket, you close the ticket, and the evidence inside it is forgotten. Ticketra is observable-centric. This page explains that design choice and its consequences.

Observables are first-class and reusable​

An observable — an IP, a file hash, a domain, a username — is not just a field on a case. It is a durable entity in a shared registry that persists across every case and alert it ever appears in.

Each time the same value is seen, Ticketra records a sighting against the same observable rather than creating a new one. Over months, an observable accumulates a history: where it's been seen, how it was tagged, what threat intel said about it. That is institutional memory your team can search and reuse.

Why this matters​

  • Pivoting. From one observable you can immediately see every case and alert it touched — the natural investigative pivot.
  • Enrichment is cached and shared. A CTI verdict fetched once benefits every future case that references the observable.
  • Trends emerge. A host that keeps reappearing across unrelated cases is a signal you'd miss in a case-centric tool.

Ticketra surfaces correlations — "this observable also appears in Case #1119" — but it never automatically links cases or merges them.

This is a design principle, not a missing feature

Auto-correlation in a SOC creates false trails: two cases sharing a common CDN IP are not the same incident. Ticketra presents the correlation and lets a human decide. The analyst stays in control of the investigative narrative.

This is why you'll see correlation hints throughout the UI but always an explicit human action to act on them.

Enrichment boundaries​

Because observables are sent to external threat-intel providers, the model has guardrails:

  • Only enrichable types are ever sent: IP, DOMAIN, HASH_MD5, HASH_SHA1, HASH_SHA256.
  • Private/internal IPs are suppressed — never transmitted externally.
  • Outbound payloads are minimized to the observable value itself.

See Connect a CTI provider for the practical side.