c4.14 Add security orchestration and ticketing

Track every incident with a ticket

Give each incident a ticket to track progress. Use your existing ticketing system or a Security Orchestration, Automation and Response (SOAR) platform. Key practices:

• Auto-escalate tickets not acknowledged or past SLA.
• Ownership — whoever takes a ticket owns it until another person explicitly takes over. Never fire-and-forget an issue into an inbox; confirm the receiving team has it and the context to proceed.
• Document every significant action for learning and forensics.
• Correlate IoCs with past incidents and external threat intelligence to identify actors and tactics.
• Metrics/KPIs — reflect the response phase (detect, analyze, contain, eradicate, recover) in ticket status, measure time in each phase, and report monthly or quarterly.
• Auto-enrich tickets with context about the affected asset; generative-AI summarization can help.

Center on AWS Security Hub

AWS Security Hub is the natural hub for orchestration and ticketing. It aggregates and correlates findings from Amazon GuardDuty, Amazon Inspector, Amazon Macie, Security Hub CSPM, and AWS Partner solutions, normalized to the Open Cybersecurity Schema Framework (OCSF) so downstream tools consume a consistent format.

• Ticketing — Security Hub integrates bidirectionally with Jira and ServiceNow (ITSM): create and update tickets from findings automatically or manually, and sync status back, so incidents live in the workflow your teams already use.
• Extend with partners — the Security Hub Extended plan brings a curated set of AWS Partner solutions (for example CrowdStrike, Splunk, Okta, Zscaler, Proofpoint) to extend detection and response beyond AWS across your enterprise estate.

SOAR platforms

Major SOAR platforms integrate with AWS Security Hub and AWS broadly to take action — some emphasize ticketing, others automation. For example, Splunk SOAR consumes findings forwarded via Amazon EventBridge, and Palo Alto Cortex XSOAR ships content packs for many AWS services. Choose based on whether your gap is ticketing, automation, or both.