Autotask ticketing integration

This article describes the benefits of integrating Graphus with Autotask and provides the steps for doing so.

Prerequisites 

• You must have active Graphus and Autotask accounts.
  
• You must be an admin in both accounts to configure the integration. 

Introduction 

Now you can connect Graphus with Autotask and have tickets created automatically in Autotask for each of the Graphus alert types you select: Quarantine, EmployeeShield, and Phish911.

Integrating Graphus with Autotask will allow you to use Autotask as your central ticketing hub where you can monitor Graphus alerts from within Autotask. You will no longer need to rely on Graphus email notifications or monitor alerts from within Graphus. 

This integration provides you with the following benefits:

• Manage tickets for all your organizations and customers in one central location in Graphus.
• Set ticket attributes in Graphus for each alert type. Or, continue to manage attributes in Autotask via Ticket Categories.
• Allow Graphus to close tickets in Autotask automatically. This keeps Graphus alerts and Autotask tickets in sync and prevents tickets from being left open for alerts that have been closed within Graphus.
• Provide easier workflow for your technicians. When a ticket is created in Autotask, a URL in the ticket leads to a dedicated alert investigation page in Graphus.

Integration tasks

The steps for integrating Graphus with Autotask are described in the following sections. Once the integration is complete, you will be able to investigate alerts in Graphus for the alert tickets created in Autotask.

1. Activating the integration 
   Graphus must be authenticated with Autotask. Authentication establishes the connection between Graphus and Autotask.
2. Setting up ticketing integration 
   Set ticket attributes for each alert type, such as priority and ticket category. 
3. Mapping organizations and selecting alert types 
   Map each active Graphus organization to an Autotask organization. If the name of a Graphus organization matches the name of an Autotask organization exactly, the mapping occurs automatically. For each mapped organization, you select the Graphus alert types for which you want tickets to be created. 
4. Investigating alert tickets
   Click the URL provided in the Autotask ticket to be redirected to a dedicated page in Graphus where you can investigate the alert and take action.

Activating the Integration

To activate the integration between Graphus and Autotask:

1. Log into Graphus.
2. On the top menu, click MSP Administration.
3. In the navigation menu, click Integrations.
4. In the Autotask Ticketing row, click the Connect icon.
   
   
5. You are redirected to the Autotask login page. Proceed to log in with your Autotask login credentials and your authentication code.
   
   
6. On the Authorization page, click Authorize. This will authorize the integration between Graphus and Autotask and establish the connection.
   
   Note:  If authorization is unsuccessful, an error message is displayed.  Contact an Autotask administrator or support. 
7. After authorization is completed, you will return to the Graphus Integrations page. Click the Autotask Ticketing hyperlink.
   
   
8. The Autotask Ticketing organization mapping table is displayed. The mapping table is the central location to manage ticketing for all your different organizations.
   
   

Setting up ticketing integration

Integration Settings

While you can set ticket attributes in Autotask via Ticket Categories, you also have the option of selecting them in Graphus. In the Integration Settings modal, you can define ticket attributes for each alert type. The values available for each attribute will come from the Autotask API. The selections you make apply to all organizations for which the alert type has been selected.

Important: Defining ticket attributes in the Graphus Integration Settings modal is optional. If you do define ticket attributes in Graphus, they will override those set in Autotask. If you don't define any ticket attributes within Graphus, Autotask will create tickets using the Autotask default values.

The attributes available for each alert are described below:

• Ticket Priority: Defines the priority of a ticket based on the severity with which it gets created.
• Ticket Category:  Defines many different values for a ticket and is managed by you on the Autotask side.
  Note: If you use Ticket Category and also set up a ticket attribute within Graphus (e.g. Status), the value defined via the Graphus dropdown will override the value you defined in the Ticket Category in Autotask.
• Status: Defines the status in which a ticket will get created.
  Note: You cannot select the Allow Graphus to close tickets option (see next bullet) if the Status selected is the Autotask default status Complete.
• Allow Graphus to close tickets: When selected, Graphus will automatically close the ticket in Autotask when you take action on the alert (see the section Closing tickets).

To select integration settings: 

1. On the Autotask Ticketing page, in the upper-right corner, click the Integration Settings button.

2. Select integration settings for the desired alerts.

3. Click Apply.

Mapping Organizations and Selecting Alert Types

You map your Graphus organizations to your Autotask organizations on the Autotask Ticketing mapping table. Also, for each mapped organization, you select the Graphus alert types for which you want tickets created. 

Automatic Mapping

While activating the integration, an initial synchronization will try to match your Graphus and Autotask organizations and establish a mapping. A Graphus organization is automatically mapped to an Autotask organization when both names match 100%.

If desired, you can select a different organization in the Autotask Organization column (see the Manual Mapping section).

Note: One Autotask organization can only be linked to one Graphus organization. Organization names are case-sensitive. If there is more than one organization with the same name in Autotask, Graphus will not auto-map the organization. It is recommended that each organization in Autotask has a unique name.

Manual Mapping

For organizations that cannot be mapped automatically, you need to perform the mapping manually. For those organizations, Select an Organization is listed in the Autotask Organization column.

To manually map a Graphus organization with an Autotask organization:

1. For the applicable Graphus organization, in the Autotask Organization column, click Select an Organization. 
2. In the drop-down list, select the name of the desired Autotask organization.
   
   
   
3. Click Save. 
   
   

Notes:

• Organization names are case-sensitive.
• The organization selected in the Autotask Organization column can be changed later by selecting a different organization and clicking Save.
• If you added an organization to Autotask or updated its name, you need to click the Sync button to start a manual synchronization.

Sync

Sync button: You can synchronize active organizations using the Sync button. This will instantly synchronize your Autotask organizations in case you add a new organization to Autotask or change its name. Clicking the Sync button will also start the automated organization mapping for all new Graphus organizations that were added after the initial activation of the integration.

Selecting alert types

Graphus has three alert types: Quarantined, EmployeeShield, and Phish911. For each mapped organization, you select the Graphus alert types for which you want tickets to be created. For example, if you choose only the Quarantined alert type for an organization, Autotask will create tickets for this alert type only.

Important: At least one alert type must be selected for an organization for a ticket to be generated for that organization.

To select an alert type: 

1. For the applicable Graphus organization, select the check box of the desired alert types.
   
   
2. Click Save. A confirmation message is displayed. 
   

   

Note: You can deactivate/pause the ticket creation for a particular alert type by clearing its check box and clicking Save.

Closing tickets

When Autotask ticketing integration is active and the Allow Graphus to close tickets option is selected, Graphus will automatically close the related Autotask ticket as soon as someone takes action on the alert. Graphus will move the ticket's status in Autotask to Complete.

Actions

Graphus will automatically close a ticket in Autotask if a user takes one of the actions stated in the table below. A ticket will only be closed one time. Graphus will add a note in Autotask with detailed information about the action taken (see the section Autotask Reason field). Multiple actions taken on one alert will not cause multiple tickets to be closed or multiple notes to be created.

Note: Closing the investigate modal or leaving the page is considered a non-action.

Close Ticket button

For Quarantine alerts, if you don't want to unquarantine an email, the Close Ticket button allows you to close the Autotask ticket. The button will only be visible if the integration is active and the Allow Graphus to close tickets option is selected for the Quarantine Alert.

Here is an example of the Close Ticket button in the Investigate modal. 

When the Close Ticket button is clicked, the Close Autotask Ticket modal is displayed.

Autotask Reason field

When Graphus closes an alert, the following information is entered into the ticket's Reason field in Autotask:

• General comment “The ticket was automatically closed after investigating the alert.”

• Graphus email address of the user who reviewed the alert.

• Action taken, for example, Close Ticket.

• Date and time including the time zone.

Autotask Reason field - EmployeeShield alerts and report false-positive

The EmployeeShield banner allows email recipients to provide feedback via different links if this feature is activated in the Graphus settings. One type of feedback a recipient can provide is to mark a banner as false-positive. This will remove the banner from the email, provide feedback to the AI, and also close the alert within Graphus. If this alert gets closed by an email recipient, you will see the email address of this recipient as user in the reason field of Autotask.

Investigating alert tickets 

Investigation methods  

There are two possible methods for investigating an alert in Graphus and taking action to close the ticket in Autotask: 

• Method 1: In Autotask, you can click the URL provided in the ticket and be redirected to the alert's Message ID page in Graphus where you can investigate the alert and take action. 

  
  
  Note: For more details, refer to the section Investigating an alert when starting with an Autotask ticket.

• Method 2: In Graphus, you can investigate an alert and take action via one of the following: 

  • Actions column in the alert table

  • Investigate modal

  • MessageID page

When you investigate an alert starting in Graphus (i.e., you are not starting in Autotask) and take action, the ticket related to the alert will be closed automatically in Autotask (as long as the Allow Graphus to close tickets option is selected).

Investigating an alert when starting with an Autotask ticket

When a ticket is created in Autotask based on a Graphus alert, the ticket displays alert-specific information. This includes the following:  

• Name of the Graphus organization.
• Time and date the alert was created.
• Alert details such as the type of attack and the sender's email address.
• Direct URL to the Message ID page in Graphus where you can investigate the alert and take action.

To investigate an alert when starting with an Autotask ticket: 

1. In Autotask, click the applicable account link.
2. On the Open Tickets page, click the Ticket Number (or Title).
   
   
3. In the Description text, click the link to view the alert in Graphus.
   
   
4. You are redirected to the alert's Message ID page in Graphus which opens on a new browser tab. 
   Note: If you are not already logged into Graphus, the Graphus login modal is displayed. After logging in, the alert's Message ID page is displayed.
   
   
5. Investigate the alert and click the applicable action button. 
   Note: The Close Ticket button is available only for Quarantine alerts. 
   
   
6. In the confirmation modal, click Proceed.
   Note: For actions other than Close Ticket, their existing confirmation messages will continue to be displayed.
   
   • Example of the confirmation modal when the Close Ticket button is clicked: 
     
     
   • Example of the confirmation modal when the Unquarantine button is clicked:
      

Note: When you click Proceed in the Close Autotask Ticket confirmation modal, a message displays that you have successfully closed the Autotask ticket. You can close the Graphus browser window.

Disconnect the integration

Disconnecting the Autotask Ticketing integration will remove the mapping and stop synchronizing between organizations. Tickets will no longer be generated in Autotask for Graphus alerts.

You can manually disconnect the integration with Autotask on the Integrations page.  

To deactivate the integration between Graphus and Autotask:

1. Go to the Integrations page.
2. In the Autotask Ticketing row, click the Disconnect icon.

3. Clicking the Deactivate button will disconnect the connection between Graphus and Autotask.