Skip to content

Using the ticket log

The ticket log in Coro provides a record of all tickets generated in the current workspace. These tickets are detailed records of all detected suspicious events or a series of suspicious events.

To learn more about how Coro creates and uses tickets, see Tickets in Coro.

View the ticket log by logging into the Coro console and selecting the ticket log icon in the toolbar:

Accessing the ticket log


The ticket log link in the toolbar shows all tickets in the system and provides an overview of the current ticket queue. To view tickets for a specific module, or of a specific type, use the ticket links provided in each detailed dashboard panel in the Actionboard. To learn more, see The Actionboard.

Coro raises tickets for all protected users, and also for protectable users. Protectable users are those user accounts that Coro is able to identify from your connected cloud applications, but that have not been explicitly added for protection. Tickets raised for protectable users are done so as information-only without any remediation options, in order to highlight events to Admin users to inform how protection might be extended or reconfigured. Such tickets are automatically closed upon being raised.

The ticket log contains the following features:

The Ticket Log

The left pane shows a summary of the ticket queue, based on the selected filters. Select a ticket to see details in the right pane.

Coro provides the following for each ticket:

  • Information describing the ticket. For example, the user affected, the date the ticket was opened, the file name and size, and more.

  • Further ticket details, findings, and a summary of recent activity that has been performed for this ticket. To view a complete list of all activity relating to the ticket, select the All Activity link.

  • A Comments section, enabling an Admin user to record specific comments and notes regarding the event against a ticket. To learn more, see Create a ticket comment.

  • An Actions button that provides relevant actions for the ticket.

    For example, a ticket of type "Suspicious Content" shows the following actions:

    Actions menu

    Action Outcomes
    Re-open Reopen this ticket for Admin user intervention and manual remediation.
    Contact user Coro sends an email to the recipient containing a message and the ticket info.

    An action: "Contact User" is recorded in the Ticket Log and Activity log.
    Download Eml File Download the suspicious email (.eml format).

    This allows you to thoroughly examine potentially malicious emails before taking any further action.

    For further information, see Downloading suspicious emails for further inspection.
    Allow Coro presents a dialog offering you the choice of either allowing this email (return it from the quarantine folder back to the original recipients), or allowing this email and optionally adding the sender's email address or domain to the workspace allowlist.
    Block Coro presents a dialog offering you the choice of either Permanently deleting this email, or deleting the email and optionally adding the sender's email address or domain to the workspace blocklist.


    Actions might vary depending on type and status of the ticket. For example, an open ticket of a particular type might contain more available actions than a ticket that has been closed.


    When a device is removed from protection, all open tickets associated with the device are automatically closed.


    Tickets raised for protectable users are automatically closed and have no remediation Actions available.

    To learn more about the actions for each ticket type, see:

Above the ticket summary list, you can choose to display all tickets, only open tickets, or only closed tickets. You can also filter the Ticket Log using the drop-down selectors to the right.

Choose filters for:

  • Security module: The main component of protection as provided in the Actionboard. For example, Cloud Security. (select Everywhere for all security modules)
  • Type: A dynamic list of ticket types relevant to the selected module.
  • During: A selected time period for the ticket log. Choose from a number of preset periods, or specify a date range by using the calendar.

You can also search the ticket log using free text.

Adding comments to tickets

Comments can be added to tickets. This is advantageous for both Coro customers and Coro SOC team members when communicating ticket analysis and recommended actions. Comments can also provide general information.

Comments in tickets can increase the efficiency of ticket resolution by eliminating the need to manually communicate ticket-related information via email or other messaging platforms.

In addition, customers will be able to respond to SOC's analysis and add their own general notes to tickets. Comments can also be sent to customers directly from the Coro console.

Creating a ticket comment

To create a ticket comment:

  1. Log into the Coro console and navigate to the Ticket Log.
  2. Select the ticket to which you would like to add a comment.
  3. Select the Comments icon, located next to the Actions button:

    Ticket Comments icon

    The Comments section is displayed:

    Ticket Comments section

  4. Select +.

    The New comment dialog is displayed:

    Ticket New comment dialog

  5. Enter your comment into the Comment field.


    There is no limit to the total number of characters in comments.


    Comments must contain at least one character in order to be saved.

  6. Select ADD.

    Add the ticket comment

    The comment is saved and displayed under the Comments section:

    Ticket comment added


    Saved comments cannot be edited or deleted.

Emailing a ticket comment

Ticket comments can be emailed in order to notify the following recipients:

  • Affected users: Emails the ticket comment to the ticket recipient.
  • All workspace admins: Emails the ticket comment to all workspace admins
  • Custom recipients: Emails the ticket comment to one or more specified email addresses.

To email a ticket comment:

  1. Create a new ticket comment.

  2. Expand the Email Comment dropdown:

    Email Comment dropdown

    The email notification options are displayed:

    Email notification options

  3. Select one or multiple notification options:

    Selected email notification options

  4. Select ADD.

    The ticket comment is saved and the selected recipients are notified via email.

    Confirmation is displayed under the Comments section:

    Ticket comment recipient notification

    The email notification recipient(s) can view the ticket comment from their inbox:

    View the ticket comment from inbox

    The email notification recipient(s) can click the link within the email to navigate to the corresponding ticket in the Ticket Log:

    Select the link within the email

Closing or reopening multiple tickets together

To close multiple open tickets at once without remediation, use the checkboxes adjacent to each ticket in the summary pane.


Make sure you have first reviewed all tickets that you intend to close.

Use the checkboxes to select or deselect each ticket you want to close. Or, to select all tickets in the current view, use the checkbox at the top of the list.

When one or more tickets are selected, Coro displays a dedicated Actions menu button at the top of the pane. To close all currently selected tickets without any further remediation, select Actions > Close tickets.

Apply the same process if you want to reopen multiple closed tickets. Go to the Closed tickets list and select or deselect each closed ticket you want to reopen. Then, select Actions > Reopen tickets. Coro places each selected ticket back into an open state.