It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda XDR

Working with the View Ticket Page

  • Last updated on

The View Ticket page lets you see all the details of a ticket. From this page, you can view the following for the ticket:

  • ID

  • Subject

  • Account

  • MITRE ATT&CK® Tactic

  • MITRE ATT&CK® Technique

  • Created Time

  • Completed Time

  • Target User

  • SOC Analyst

  • Closure Code

You'll also find other details, such as the name of the incident, risk level, how the threat was detected, and what you should do about a ticket.

Besides seeing the details of a ticket, from this page, you can also:

  • Suspend users - You can suspend a Microsoft 365 or Duo user who is the source of a ticket.

  • Block and unblock IPs - If you have a firewall configured, you can block IP addresses that are the source of a ticket.

You can navigate to the View Ticket page two ways:

  • By clicking Intelligence > View Ticket in the left navigation menu. If you navigate this way, you'll have to enter a Ticket Id in the top right corner.

  • By clicking a row in the All Tickets table on the Alarms & Alerts page. If you navigate this way, the ticket you clicked is displayed.

On the View Ticket page, you can also do the following:

Suspending Users

Blocking and Unblocking IP Addresses

To view the View Ticket page
  • Do one of the following:

    • To search for a ticket, click Intelligence > View Ticket, then type a Ticket ID in the top right of the View Ticket page.

    • To view a specific ticket, click a row in the All Tickets table on the Alarms & Alerts page. Then click View Ticket Details View Ticket Details.png .

To suspend a user
  1. While viewing a ticket on the View Ticket page, in the Target User row of the Ticket Details section, click Suspend User.

  2. Select one or more of the following:

    • Microsoft 365: revoke sessions and block sign-in.

    • Okta: suspend user account.

  3. Click Submit submit.png .

To block or unblock an IP address
  1. While viewing a ticket on the View Ticket page, in the Source IP row of the Ticket Details section, click Block/Unblock IP.

  2. Select a firewall.

  3. Select one of the checkboxes:

    • Block

    • Unblock

  4. Click Submit submit.png .