Setup a Playbook to Automatically Create Zendesk Tickets

Issue

We are using Zendesk to track our company's tech support cases as well as our security incidents.  How can we setup Red Canary to create a new ticket in Zendesk whenever a threat is detected? 

Environment

Red Canary Portal
   Automation

Resolution

While the Red Canary Portal does not currently have any built-in Zendesk playbook actions, you can workaround this using the Invoke Webhook or API playbook action and Zendesk's API.  Before getting started, you will need to generate an API token in Zendesk and BASE64 encode the authentication string, if you have not already.

To configure this automation, follow the steps below.

1. Navigate to Automation > Playbooks, then click Create New Playbook
2. Click Add Action then add the Invoke Webhook or API action
3. Configure playbook action fields as follows, replacing the <angled bracket> values with your own, and the brackets removed
   • HTTP Method: POST
   • URL: https://<MySubdomain>.zendesk.com/api/v2/tickets
   • Allow Untrusted Connections: No
   • HTTP Headers:  See code block below

     • authorization=Basic <BASE64EncodedString>
       content-type=application/json

   • Payload: Custom Payload

     • {
         "ticket": {
           "comment": {
             "body": "Summary: $JSON:Detection.details\n Published: $JSON:Detection.published_at\n Link: $JSON:Detection.url"
           },
           "priority": "<low|normal|high|urgent>",
           "subject": "$JSON:Detection.headline"
         }
       }

4. Provide the playbook a name and/or description, then click Save to finalize changes
5. The playbook configuration should look similar to the following screenshot

   • 

6. Navigate to Automation > Triggers, then click Configure New Trigger
7. From the list of triggers, select When a Threat is Published
8. Under the newly created trigger, click Add Condition and add the following trigger
   • Threat > Severity > Is one of > High, Medium > Save
9. Click Connect Playbook and connect your new Invoke Webhook or API playbook
10. The final set of automation should look similar to the following screenshot

    • 

Key Concepts and Troubleshooting

• A correctly encoded BASE64 string should look similar to the following truncated example in your playbook's header

  • authorization=Basic ABCdef123gHiJKL[...]456Mnop78qr9TUV000wx0yZ

• Some available object attributes may translate to text that includes invalid escaped characters in JSON strings, such as \, which will result in the playbook failing unless the attributes are formatted as $JSON:Variable.name in the payload
• If the playbook action's Payload is set to All Attributes as JSON, the action will fail as a Custom Payload is required to pass valid fields to the Zendesk API
• The example payload template can be customized to fit your needs, including applying any custom or required fields, though comment is a required field
• To create Zendesk tickets via API, the user must have any Agent role applied in Zendesk, including a custom role or Light Agent
• API tokens unused for 30 days will be automatically deleted by Zendesk and agent accounts created after July 28, 2026 cannot create API tokens (see this notice for details)

• To test your API call independent of Red Canary's platform, run the following command from your system's CLI (e.g. CMD, PowerShell, Terminal, etc.) or API client, replacing the <angled bracket> values with your own and the brackets removed (leave quotations intact where present)

  • curl --request POST \
      --url https://<MySubdomain>.zendesk.com/api/v2/tickets \
      --header 'authorization: Basic <BASE64EncodedString>' \
      --header 'content-type: application/json' \
      --data '{
      "ticket": {
        "comment": {
          "body": "My API permissions and payload syntax are correct."
        },
        "priority": "low",
        "subject": "This is a test"
      }
    }'

  • If this test fails, troubleshoot any returned errors by referring to Zendesk API documentation and/or Zendesk support to verify your API permissions or chosen fields and values

NOTICE:  Zendesk plans to permanently deactivate all API tokens on April 30, 2027, deprecating the authentication method in favor of OAuth 2.0.  See this Zendesk notice for details.

Because our Invoke Webhook or API playbook action is incompatible with OAuth, related playbooks will become inoperable with the Zendesk API at that time. 

Cause

Red Canary does not currently offer a built-in playbook action for creating Zendesk tickets.  However, the Zendesk API can be used in conjunction with the Invoke Webhook or API playbook action as a highly-customizable workaround.