Core concepts

A quick tour of the vocabulary you'll see throughout Ticketra.

Observable

An observable is an atomic, reusable piece of evidence — something you can point at and say "this is interesting." Observables are the heart of Ticketra: they persist across alerts and cases so your team accumulates knowledge.

Supported observable types:

IP · USERNAME · HOSTNAME · HASH_MD5 · HASH_SHA1 · HASH_SHA256 · DOMAIN · URL · EMAIL · FILE_PATH · MAC_ADDRESS · PORT

Each observable can be tagged, enriched with threat intelligence, and linked (by a human) to the cases where it appears. A sighting records each time an observable is seen.

Event schema

Ticketra treats event schemas as first-class entities rather than raw, opaque event codes. A schema describes the shape and meaning of a class of events, and has a lifecycle: draft → published → deprecated. This lets a team standardize how it interprets incoming data.

Case

A case is an investigation. It moves through a defined status machine:

A case carries tasks, comments, tags, attachments, and ordered sequence steps that document the investigation timeline.

Source type

Where ingested data comes from. Ticketra recognizes three source types: WINDOWS, LINUX, and NETWORK.

Tenant

A tenant is an isolated workspace. Users, cases, schemas, and observables are scoped to a tenant. System users (with no tenant) can operate across all tenants — useful for an MSSP or a central security team managing multiple groups. See Multi-tenancy for the full model.

Milestone

A milestone tracks analyst progress and achievement against defined goals (for example, cases created or resolved), giving teams lightweight gamification and visibility into activity.

Roles

Ticketra ships with three built-in role levels and supports custom roles:

Role	Scope
SUPER_ADMIN	Full access; sole user manager.
ADMIN	Operational admin: cases, schemas, config, integrations, milestones.
USER	Investigation workflows: cases, observables, ingestion.

Next: see how these pieces fit together in the Architecture overview.