Skip to main content

Create Atera tickets from events and threats.

Managing tickets in Atera via the Keep Aware Atera Integration

Requirements​

  1. Access to the Keep Aware Console: Ensure you have valid login credentials and are logged in to the console.
  2. Permissions to configure API keys to your Atera Environment: Confirm that you have the necessary permissions to add new API keys in your Atera environment.

Setup an API key in Atera​

First you will need to setup an API key in Atera or you can use one you have already created.

For information regarding setting up API keys in Atera refer to their documentation below.

Atera API Keys

Setting up Atera in Keep Aware​

To get started, navigate to the Integrations Page and select the Atera integration. This will open a modal where you can select Create New Integration and begin configuring the integration.

Integrations Page Image: Integrations Page

View in console

Here we will configure each of the fields below:

  • Identifier: A unique name for your Atera Integration.
  • API token: Your Atera API token.
  • Body: This is the JSON body that will be sent to Atera. See below for information on customizing the event body.

After you save the integration, that will complete the basic setup for getting Atera connected to Keep Aware.

Continue below for how to customize the body that is sent to Atera.

Customize the Ticket created in Atera​

All payloads sent to Atera utilize wildcards and will be populated with values gathered from the Event or Threat that triggered this integration on a Policy.

Here is an example body that utilizes wildcards. All values wrapped in double-curly brackets will be replaced with their corresponding value on the Event.

{
  "TicketTitle": "[TEST] Keep Aware | Access Request | {{id}}",
  "Description": "A user has submitted an access request through Keep Aware\n\nType: {{type}}\nUser: {{user.label}}\n\nLocation/Hostname: {{location}}\n\nRequest Event:\n<a href=https://console.awarefilter.com/explore/events?query=_id:%22{{id}}%22>Request for {{location_full}}</a>\n\nRestriction Event:\n<a href=https://console.awarefilter.com/explore/events?query=_id:%22{{session.prev_hit}}%22>Restricted {{type}} for {{location_full}}</a>\n\nLists: {{lists}}\n",
  "TicketPriority": "Low",
  "TicketImpact": "NoImpact",
  "TicketType": "Request",
  "EndUserFirstName": "{{user.id}}",
  "EndUserLastName": "{{user.label}}",
  "EndUserEmail": "{{user.email}}"
}

Further details on all of the wildcard fields that may be used in the Body are available in our Searching documentation under Event and Threat Fields.

To forward user access requests to Atera, see Create an exception workflow.

Frequently Asked Questions​

QuestionAnswer
How can I find out what Event and Threat fields can be used in the body payload sent to Atera?All available Threat and Even fields are described and documented in the Event and Threat Fields Documentation

Table of Contents