Skip to main content

Your first investigation

Analyst

This tutorial walks you through the core Ticketra workflow end-to-end: you'll create a case, work an observable, enrich it with threat intelligence, and resolve the case. No prior setup beyond a running stack and a login is required.

By the end you'll understand the loop every investigation follows in Ticketra.

The workflow at a glance​

1. Create a case​

  1. From the sidebar, open Cases and click New Case.
  2. Give it a title (e.g. "Suspicious outbound connection from finance host") and a severity.
  3. Save. You now have a case in the OPEN state.

The case is automatically assigned a human-friendly case number and you become its creator.

2. Add an observable​

Inside the case, add the evidence you're investigating — for example a suspicious IP address.

  1. In the case, find the Observables section and add one.
  2. Choose the type (IP) and enter the value.

Ticketra records this as a sighting and adds the observable to the shared observable registry, where it can be reused across future cases.

Correlation is surfaced, not forced

If this observable has been seen in other cases, Ticketra will show you that correlation. It will not auto-link the cases — you decide whether they're related.

3. Enrich with threat intelligence​

If an admin has configured a CTI provider (see Connect VirusTotal), you can enrich the observable:

  1. Open the observable and choose Enrich.
  2. Review the verdict returned by providers such as VirusTotal or AbuseIPDB.

Enrichment can auto-tag the observable (for example, malicious) based on the verdict.

Private IPs are never sent externally

Ticketra suppresses private/internal IP addresses before contacting any external provider. Only enrichable types (IP, domain, and file hashes) are ever sent.

4. Document the investigation​

Use the case's tools to capture your work:

  • Tasks — track to-dos (e.g. "Block IP at firewall").
  • Comments — record observations and discussion.
  • Sequence steps — build an ordered timeline of what happened.
  • Attachments — add supporting files (PCAPs, screenshots).

As you work, colleagues see your presence and changes update live thanks to real-time streaming.

5. Move the case through its lifecycle​

Transition the case as the investigation progresses:

OPEN → start → IN_PROGRESS → resolve → RESOLVED → close → CLOSED

If new information appears later, you can reopen a closed case.

6. Review the audit trail​

Every significant action you just took — case creation, status changes, enrichment — was recorded in the append-only audit log. Admins can review it under Audit Log.

What you learned​

You've completed the full Ticketra loop: observe → enrich → investigate → resolve. From here: