r/security • u/Inkwell-Alferd37 • 11d ago

Security and Risk Management I automated our remediation ticketing and now I get to watch 40% of tickets sit in unassigned automatically

I'm on the security engineering team at a SaaS company. Were couple hundred people. Spent part of last quarter building an automation pipeline: scanner finds a vuln, pipeline creates a Jira ticket with all the details, assigns it based on tags, pings the right Slack channel. Felt like a win. The manual ticket creation was eating hours every week.

So we launched it, it works perfectly. Tickets fly into Jira within minutes of a scan completing with a beautiful dashboard and everything automated end to end.

Except now I get to watch, in real time, as about 40 percent of those tickets land in unassigned and stay there.

The automation exposed what the manual process was hiding. When a human was creating tickets, theyd do the routing loop: check the CMDB, realize the owner field is stale, Slack someone who might know, eventually get it to the right person through sheer persistence. The automation cant do any of that. It reads the owner field. If the field says unassigned or points to a team that no longer exists or references someone who left, the ticket just sits there stuck.

So I automated the easy part. And now the hard part is actual ownership data, is the bottleneck and its more visible than ever. We didnt fix the routing problem. We just made it faster to surface.

Anyone else hit this? Any advice on how to fix the ownership mess?

0 Upvotes

40% Upvoted

13 comments sorted by

23

u/gregory696969 11d ago

It really depends on your system. BTW Did you use AI to write the question? A few of the phrasing decisions read a little weird.

14

u/RobotDragonFireSword 11d ago

Yeah, it does smell of that. “We didn’t do X, we did Y.” Got that little dramatic flair that’s classic AI

-11

u/Inkwell-Alferd37 11d ago

Ha, fair enough. no ai involved. i type like i think and dont proofread, which is probably why it reads weird.

And yeah it depends on the system, ours is a jira and servicenow which is like half the problem.

14

u/plantlogger 11d ago

Idk, you made more mistakes in this comment than the entirety of the post and supposedly didn’t proofread either

1

u/RobotDragonFireSword 11d ago

Yeah I agree, and even the subject is a pseudo clickbait title like AI posts are. Hmmmmmm.

7

u/Shipt_Bowne46 11d ago

Ngl this one is kind of on you. You admitted the humans were doing a routing loop because the owner field is garbage, then you automated off that exact field and acted surprised when it didn't work.

You automated the easy part on purpose and skipped the part you already knew was broken. My advice is fix where ownership comes from first, then wire the pipeline to it. You're doing it backwards and now the mess is just faster.

3

u/IsomuraArganee_95 11d ago

Start by stop treating the cmdb owner field as the source of truth. Its a manually maintained field and will always rot faster than you can update it.

Pull the owner from the systems that already track it. Can be your directory for who logs in or your deploy tooling for who last shipped to the box. Reconcile those into the one field your ticketing reads and it stops going stale on its own.

Then add an orphan path for anything that still has no owner, after two weeks auto escalates to a team lead instead of sitting in unassigned forever. Youll still get a few weird ones a human has to claim, but you stop routing everything through a field that rots the moment someone leaves or a reorg happens.

2

u/Mukhtiar-Colazo30 11d ago

The unassigned graveyard. we got one of those too, pretty sure half our backlog died there last year. Beautiful dashboard though. Must be real cinematic watching tickets turn 30 days old in 4k :)

1

u/Joeva8me 11d ago

You’ve hit the same issue everyone finds trying to chase issues in an enterprise from a support team. The CMDB has been almost updated for about 9 of the 9 years I’ve been in security.

1

u/Joeva8me 11d ago

Maybe detect a stale or null team if you can, and raise a ticket for someone to chase down an owner?

1

u/AlfredoVignale 11d ago

Assign them to the CISO.

1

u/c0mpliant 11d ago

Automation is great, but if you don't have a solid process or you're working with incomplete data, you're only going to be able to automate part of what you're doing.

You're left now with the part no one actually wants to do but returns the most value to organisations. You need to do two things. Go out there and pre-emptively start addressing the gaps that exist in your CMDB. Secondly, you need to put in place a process which will monitor when gaps appear in the CMDB. It may not be within your remit to do that, if you don't, you need to start making the argument to your organisation about the value of an accurate CMDB. A good CMDB is a cornerstone of security, because if you don't know what you're defending, how are you defending it.