Ticketing & ITSM Integrations

ManySignal creates Jira issues automatically when a verdict crosses a configurable confidence threshold. The ticket includes: alert summary, evidence chain, affected entities, recommended actions, and a link to the ManySignal investigation workspace. Fields, project, and issue type are all configurable.

Yes. ManySignal can update Jira and ServiceNow ticket status as the investigation proceeds — when new evidence is added, when the verdict changes, or when a response action is taken. Bidirectional sync keeps the ticket and ManySignal investigation in sync.

Yes. For Critical severity verdicts, ManySignal can trigger PagerDuty incidents directly, paging the on-call analyst with the full alert context. PagerDuty incidents can also be automatically resolved when ManySignal closes an investigation.

Yes. ManySignal queries ServiceNow CMDB to enrich alerts with asset owner, business service mapping, and criticality tier. This enrichment helps prioritise investigations based on the business impact of affected assets.

Yes. Ticket creation rules are fully configurable: by severity, by detection type, by affected entity type, or by custom conditions. You can create Jira tickets for Critical and High verdicts, PagerDuty for Critical only, and log everything else in ManySignal's case queue.

Yes. ManySignal's Linear integration creates issues in your security team's workspace with full investigation context. This is popular with DevSecOps teams that manage security work alongside engineering sprints in Linear.

ManySignal's entity graph deduplicates related alerts — a single investigation covers all alerts related to the same incident. One ticket is created per investigation rather than per alert, preventing ticket flooding during high-volume events.

Yes. When ManySignal marks an investigation as resolved, it can automatically close the corresponding Jira, ServiceNow, or PagerDuty ticket, update the resolution status, and add a resolution note with the final verdict summary.

Yes. ManySignal integrates with ServiceNow SecOps module specifically — creating Security Incidents (not generic IT incidents) with the correct fields, category mapping, and SLA triggers appropriate for security events.

Yes. Severity mapping is configurable in the ServiceNow connector settings: ManySignal Critical → P1, High → P2, Medium → P3, Low → P4, or any custom mapping that fits your organisation's ITSM priority schema.