---
title: "Creating a Ticketing Automation"
slug: "creating-a-ticketing-automation"
updated: 2026-10-22T15:02:22Z
published: 2026-10-22T15:02:22Z
canonical: "docs.safe.security/creating-a-ticketing-automation"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Creating a Ticketing Automation

Balbix Automations allow users to eliminate manual tasks through one-time configuration - including ticketing, exception handling, data exports, inventory tagging, and more. Ticketing Automation enables automatic creation of tickets in third-party systems (e.g., ServiceNow, Jira) whenever matching exposures are detected, helping accelerate remediation workflows.

Follow this procedure to create a ticketing automation.

### **Step 1: Start a New Automation**

Go to Asset Vulnerabilities and click Create Automation.

Enter:

- A Name for the automation (e.g., "Test Automation ITSM Ticket")
- Type of Automation: Freeform
- Element: Asset Vulnerabilities

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXe3-XZZGv6aYMOJDadVRgyv0gJKny__J7wGNYCQMa4W6TuP0QlTI8_PTAAmDB5dF42y9LRO7FCd_10xDsuJX-9BzTgZjTovHD-ItviA39bhYOKQmd5sJyRqXcdj5NcWMDbyz0BuZQ?key=6UPkAaCiWB37PzNzS-rLuw)

---

### **Step 2: Define Scope Using Filters**

Select:

- Scope of Automation: Use new filter or Asset Vulnerabilities matching Saved Filters

Then:

- Choose a field like Name
- Set condition (e.g., "is any of")
- Enter one or more CVEs (e.g., CVE-2005-2945)

This determines the subset of vulnerabilities the automation will monitor.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcixQHiET5ggWnY3BRojvXLMnkqTY49m7DuNgQ-aEt3-i5rSUPJzk3yXrV6ZtprgnrSAqJNkq_4agTSMRanMksTBYaMXi8RkeMBi1Qm_HHXwjUy0w3W7X5bjgf4RU7k4J46eN7tog?key=6UPkAaCiWB37PzNzS-rLuw)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXd3RyEO26cKsnQThSDf1v1cJXntpDOjH3RyhLGKHU2MiJkX56_Fabd6Scn5JH4olm6YDEgn9flZNGa9FFMMKobiaVZLalUROXP4VN67flULj5GAQRJxitwiwK9QCvOPELs3YEESJA?key=6UPkAaCiWB37PzNzS-rLuw)

---

### **Step 3: Set the Trigger Condition**

The trigger defines **when** the automation should run for the selected scope. You can choose:

- **Upon Next Evaluation**: Executes automatically during the next system evaluation cycle.
- **Scheduled (Periodic)**: Runs at regular intervals (e.g., daily, weekly).
- **Scheduled (One Time)**: Runs only once at a specified time.

### ![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcYImHExdk65o_mTZotQNZjI-2qRgEcUMa0x8QAoId5Deyi7Aeb2YxLEOOfELgfeZgJ7izPAgrM-Fw36sl2cp_MWdOops8r-5BU3pYCIdkyqZTquSY2GXOD41aQlqAbH2q1jSh1?key=6UPkAaCiWB37PzNzS-rLuw)

This ensures your automation executes at the right moment based on your operational needs.

Choose:

- Automation Trigger Type: Upon Next Evaluation

This ensures the automation evaluates matching vulnerabilities in the next analysis cycle.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeG5i2eLp5cTTZrHsJ228h9f3eLPwPjIroFp44oENTKQNrq9QOanR2CLqgurjUvhUr9U9w0b4YSU2k-gLsEFTmfDZruBoz4f6sSiRWHOjYSIDQZuFBGjtiPsrDB-KiEFVatvzJM?key=6UPkAaCiWB37PzNzS-rLuw)

---

### **Step 4: Select Action – Create Ticket**

From the action dropdown, select:

- Create Ticket

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXeJOiZhfw1-rb_hk45_yUJV9HQ9nS6Aa9KPue5coc3_F-JTbNYkTWkx5oWfW_fpjlU9Gk3T66cHLotFdkFRRPtvpJS1qRsLvTY2HZtTVQcvqnkL3Ov6dNdBVXyf6Wtvcm4VlIF0Sg?key=6UPkAaCiWB37PzNzS-rLuw)

Then:

- Choose the appropriate Ticketing Rule (e.g., snow-test-rule1-balbix)

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXcFTYNEC6PKwo26RnrYCaakIM5kOdHAiwBfivCWvDB8x5Di7wlL1i9cegGhXyrimtoaLODd6Unv9PQyKJfalnSKZ8YdcqXnvvBfEndFNQCbK6CRexKOtokgoWCL4_CSF5UY4cw5ag?key=6UPkAaCiWB37PzNzS-rLuw)

This connects the automation to a preconfigured rule that defines the fields and values populated in the ServiceNow ticket.

---

### **Step 5: Define Ticketing Parameters**

Populate required ServiceNow fields:

- Short Description
- Urgency
- Impact
- Contact Type
- Severity
- Optional: SLA Choice, Reason for SLA Breach, Release for Test

Fields are pulled dynamically from the connected ServiceNow instance to ensure valid values.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXfXAONcxTfv2_ou5SJfyHTi_c_ZENpgNk9R7YfH_6-1FoyuZWSdeXn36fuzsCV_81X14Jpb8fgUI_hSCiyRBz5P952MjwynMSg7hAjLGuv_TvYbi21mMxiWTebuAp-yZKQpUtMP?key=6UPkAaCiWB37PzNzS-rLuw)

---

### **Step 6: Finalize and Activate Automation**

Review all inputs and:

- Check Make this active on creation (optional)
- Click Create Automation to complete setup

The automation is now live and will create tickets automatically based on your defined scope and trigger.

![](https://lh7-rt.googleusercontent.com/docsz/AD_4nXf1HQWSHbhYvWwN3EqUiJx0iU05uPyuPh7fyMG53p0VYING7gwQx4WgbMHOuhjqoj_wnJCWNirVM_o1r2ep6WurwyRTGP43mhZBsIbe3w5cBAo7RvgE9z69CTe0s_aJ_L6VAAeqaA?key=6UPkAaCiWB37PzNzS-rLuw)

> ### See Also:
> 
> [Ticketing Dataflows](/balbixhelp/docs/ticketing-dataflows)