Skip to main content

OTRS

This Integration is part of the OTRS Service Management XSOAR Pack Pack.#

Service management suite that comprises ticketing, workflow automation, and notification. This integration was integrated and tested with OTRS versions 5, 6, and 7.

Prerequisite#

Before configuring OTRS on Cortex XSOAR, you need to enable the webservices in your OTRS instance. It is recommended to use the provided YAML webservice configuration template, which includes the Route: /TicketList endpoint required for PyOTRS but which is not included in the default OTRS webservice setup. If you use a different file than the template, make sure to name your file GenericTicketConnectorREST.yml.

Configure OTRS on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for OTRS.
  3. Click Add instance to create and configure a new integration instance.
ParameterDescriptionRequired
serverOTRS Server URL (for example http://example.com )True
credentialsOTRS CredentialsTrue
unsecureTrust any certificate (not secure)False
proxyUse system proxy settingsFalse
isFetchFetch incidentsFalse
incidentTypeIncident typeFalse
fetch_queueQueues to fetch tickets from ("Any" fetches from all queues. CSV supported, for example Misc, Raw)False
fetch_priorityFetch tickets in priorityFalse
fetch_timeFirst fetch timestamp (formatted as <number> <time unit>, for example 12 hours, 7 days, 3 months, 1 year)False
  1. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

otrs-get-ticket#


Retrieves details for an OTRS ticket by ticket ID or ticket number. At least one input argument is required for the integration to run.

Base Command#

otrs-get-ticket

Input#
Argument NameDescriptionRequired
ticket_idTicket ID of the ticket to get details for. If not spcecified, the ticket_number argument is required.Optional
ticket_numberTicket Number of the ticket to get details for. If not specified, the ticket_id argument is required.Optional
Context Output#
PathTypeDescription
OTRS.Ticket.IDstringTicket ID
OTRS.Ticket.NumberstringTicket number
OTRS.Ticket.CreateddateTicket creation date
OTRS.Ticket.CustomerUserstringCustomer user related to the ticket
OTRS.Ticket.OwnerstringTicket owner
OTRS.Ticket.PrioritystringTicket priority
OTRS.Ticket.QueuestringQueue the ticket is in
OTRS.Ticket.StatestringTicket state
OTRS.Ticket.TitlestringTicket title
OTRS.Ticket.TypestringTicket type
OTRS.Ticket.DynamicFieldstringTicket dynamic fields
OTRS.Ticket.Article.SubjectstringTicket article subject
OTRS.Ticket.Article.BodystringTicket article body
OTRS.Ticket.Article.CreatedTimedateTicket article creation time
OTRS.Ticket.Article.ContentTypestringTicket article content type
OTRS.Ticket.Article.FromstringTicket article sender
OTRS.Ticket.Article.IDstringTicket article ID
OTRS.Ticket.Article.Attachment.NamestringTicket article attachment file name
OTRS.Ticket.Article.Attachment.SizenumberTicket article attachment file size
OTRS.Ticket.Article.Attachment.ContentTypestringTicket article attachment file content type
OTRS.Ticket.LockstringIs the ticket locked or unlocked
File.SizenumberSize of the file attachment
File.SHA1stringSHA-1 of the file attachment
File.SHA256stringSHA-256 of the file attachment
File.NamestringAttachment file name
File.SSDeepstringAttachment file SSDeep
File.EntryIDstringAttachment file entry ID
File.InfostringAttachment file information
File.TypestringAttachment file type
File.MD5stringAttachment file MD5
File.ExtensionstringAttachment file extension
Command Example#

!otrs-get-ticket ticket_id="7023"

Context Example#
{
"OTRS": {
"Ticket": {
"Age": "0 h 09 m",
"Article": [
{
"Body": "Testing",
"ContentType": "text/plain; charset=utf8",
"CreateTime": "2020-04-26 11:05:07",
"From": "\"Jens Bothe\" <jens.bothe@otrs.com\>",
"ID": "11187",
"Subject": "TestArticle"
},
{
"Body": "ClosingBody",
"ContentType": "text/plain; charset=utf8",
"CreateTime": "2020-04-26 11:05:12",
"From": "SIEM Webservice",
"ID": "11188",
"Subject": "ClosingSubject"
}
],
"Created": "2020-04-26 11:05:07",
"CustomerID": "jb",
"DynamicField": {
"Firstname": "Jens",
"Gender": "male"
},
"ID": "7023",
"Lock": "unlock",
"Number": "2020042610000031",
"Owner": "siem",
"Priority": "1 very low",
"Queue": "Inbox::SIEM",
"State": "open",
"Title": "UpdatedTitle",
"Type": "Incident"
}
}
}
Human Readable Output#

OTRS Ticket 7023#

IDNumberAgeTitleStateLockQueueOwnerCustomerIDPriorityTypeCreatedDynamicField
702320200426100000310 h 09 mUpdatedTitleopenunlockInbox::SIEMsiemjb1 very lowIncident2020-04-26 11:05:07Firstname: Jens
Gender: male

Articles#

IDFromSubjectBodyCreateTimeContentType
11187"Jens Bothe" jens.bothe@otrs.com\TestArticleTesting2020-04-26 11:05:07text/plain; charset=utf8
11188SIEM WebserviceClosingSubjectClosingBody2020-04-26 11:05:12text/plain; charset=utf8

otrs-search-ticket#


Search for an OTRS ticket using search filters

Base Command#

otrs-search-ticket

Input#
Argument NameDescriptionRequired
stateTicket states to filter for in CSV format (for example New, Open)Optional
created_beforeFilter for a ticket created before this date. (formatted as <number> <time unit>, for example 1 day, 30 minutes, 2 weeks, 6 months, 1 year)Optional
created_afterFilter for a ticket created after this date. (formatted as <number> <time unit>, for example 1 day, 30 minutes, 2 weeks, 6 months, 1 year)Optional
titleTicket Title to filter forOptional
queueTicket Queues to filter for in CSV format (for example Raw,Misc)Optional
priorityTicket priority to filter for in CSV format (for example 4High,5VeryHigh)Optional
typeTicket type to filter forOptional
Context Output#
PathTypeDescription
OTRS.Ticket.IDstringTicket ID
OTRS.Ticket.NumberstringTicket number
OTRS.Ticket.CreateddateTicket creation date
OTRS.Ticket.CustomerUserstringCustomer user related to ticket
OTRS.Ticket.OwnerstringTicket owner
OTRS.Ticket.PrioritystringTicket priority
OTRS.Ticket.QueuestringQueue the ticket is in
OTRS.Ticket.StatestringTicket state
OTRS.Ticket.TitlestringTicket title
OTRS.Ticket.TypestringTicket type
Command Example#

!otrs-search-ticket state="PendingReminder" title="7023"

Context Example#
{}
Human Readable Output#

No results found

otrs-create-ticket#


Create a new ticket in OTRS

Base Command#

otrs-create-ticket

Input#
Argument NameDescriptionRequired
titleTitle to assign to the new ticketRequired
queueQueue to place the new ticket inRequired
stateState to assign to the new ticketRequired
priorityPriority to assign to the new ticketRequired
customer_userCustomer user related to the new ticketRequired
article_subjectArticle subject to apply to the new ticketRequired
article_bodyText to add to the article body of the new ticketRequired
typeTicket type to assign to the new ticketOptional
dynamic_fieldsDynamic fields to apply to the new ticket in the format: field1=value1,field2=value2. For example: ProcessManagementProcessID=1,ProcessManagementActivityStatus=2Optional
attachmentFile entry ID of the file to add as an attachment to the new ticket in CSV format. For example: 123@20,124@21Optional
Context Output#
PathTypeDescription
OTRS.Ticket.Article.SubjectstringTicket article subject
OTRS.Ticket.Article.BodystringTicket article body
OTRS.Ticket.IDstringTicket ID
OTRS.Ticket.NumberstringTicket number
OTRS.Ticket.CreateddateTicket creation date
OTRS.Ticket.PrioritystringTicket priority
OTRS.Ticket.QueuestringQueue that the ticket is in
OTRS.Ticket.StatestringTicket state
OTRS.Ticket.TitlestringTicket title
OTRS.Ticket.TypestringTicket type
OTRS.Ticket.CustomerUserstringCustomer user related to ticket
OTRS.Ticket.DynamicFieldstringTicket dynamic fields
Command Example#

!otrs-create-ticket title="TestTicket" queue="Inbox::SIEM" state="New" priority="2Low" customer_user="jb" article_subject="TestArticle" article_body="Testing" type="Unclassified"

Context Example#
{
"OTRS": {
"Ticket": {
"Article": {
"Body": "Testing",
"Subject": "TestArticle"
},
"CustomerUser": "jb",
"DynamicField": [],
"ID": "7024",
"Number": "2020042610000049",
"Priority": "2 low",
"Queue": "Inbox::SIEM",
"State": "new",
"Title": "TestTicket",
"Type": "Unclassified"
}
}
}
Human Readable Output#

Created ticket 7024 successfully

otrs-update-ticket#


Update an OTRS ticket

Base Command#

otrs-update-ticket

Input#
Argument NameDescriptionRequired
ticket_idTicket ID of the ticket to updateRequired
titleTicket title of the ticket to updateOptional
stateTicket state of the ticket to updateOptional
priorityPriority of the ticket to updateOptional
article_subjectArticle subject of the ticket to updateOptional
article_bodyArticle body of the ticket to updateOptional
queueQueue that the ticket to update is inOptional
typeTicket type of the ticket to updateOptional
dynamic_fieldsDynamic fields to apply to the updated ticket, in the format: field1=value1,field2=value2. For example: ProcessManagementProcessID=1,ProcessManagementActivityStatus=2Optional
attachmentFile entry ID of the file to add as an attachment to the updated ticket in CSV format. For example: 123@20,124@21Optional
Context Output#
PathTypeDescription
OTRS.Ticket.Article.SubjectstringTicket article subject
OTRS.Ticket.Article.BodystringTicket article body
OTRS.Ticket.IDstringTicket ID
OTRS.Ticket.CreateddateTicket creation date
OTRS.Ticket.PrioritystringTicket priority
OTRS.Ticket.QueuestringQueue that the ticket is in
OTRS.Ticket.StatestringTicket state
OTRS.Ticket.TitlestringTicket title
OTRS.Ticket.TypestringTicket type
Command Example#

!otrs-update-ticket ticket_id="7023" title="UpdatedTitle" state="Open" priority="1VeryLow" type="Incident"

Context Example#
{
"OTRS": {
"Ticket": {
"ID": "7023",
"Priority": "1 very low",
"State": "open",
"Title": "UpdatedTitle",
"Type": "Incident"
}
}
}
Human Readable Output#

Updated ticket 7023 successfully

otrs-close-ticket#


Close an OTRS ticket

Base Command#

otrs-close-ticket

Input#
Argument NameDescriptionRequired
ticket_idTicket ID of the ticket to closeRequired
article_subjectArticle subject of the ticket to closeRequired
article_bodyArticle body of the ticket to closeRequired
Context Output#
PathTypeDescription
OTRS.Ticket.IDstringTicket ID
OTRS.Ticket.StatestringTicket state
OTRS.Ticket.Article.SubjectstringTicket article subject
OTRS.Ticket.Article.BodystringTicket article body
Command Example#

!otrs-close-ticket ticket_id="7023" article_subject="ClosingSubject" article_body="ClosingBody"

Context Example#
{
"OTRS": {
"Ticket": {
"Article": {
"Body": "ClosingBody",
"Subject": "ClosingSubject"
},
"ID": "7023",
"State": "closed successful"
}
}
}
Human Readable Output#

Closed ticket 7023 successfully