> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/platform-management/alerting/sysaid.md).

# SysAid

## Before you start

* You must use your SysAid account credentials and not SSO credentials to generate an access token. You can find them by going to your user profile in SysAid.
* Authentication is **limited to one SysAid account at a time** - the generated access token will only be able to access data from that specific account.

***

## Step 1: Create a SysAid Application Authentication

1. **SysAid Application**
   * A SysAid application is required for the alerter.
     * Please make sure you have a working SysAid application beforehand.
   * Please refer to [SysAid Getting Starter Guide](https://documentation.sysaid.com/docs/getting-started-guide) as needed.
2. **Create application key**
   * Navigate to the Developer Documentation for [SysAid public API](https://developers.sysaid.com/reference)
     * Navigate to [Create Application Key](https://developers.sysaid.com/reference/createapplicationkey) section.
     * Fill in the ***userName*** and ***password*** for your ***SysAid Account Credentials*** and ***applicationName*** of the already created ***SysAid Application***.

       ![SysAid Credentials](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1148671bf18fe00efbee71b1261ea6d91881b27c%2Fsysaid-image1.png?alt=media)
     * Fill in the ***tokenLifetime*** as necessary, though default (24 Hrs) is sufficient.
     * Make sure to fill the ***Header*** and the ***URL*** with the ***x-sysaid-accountid***, which is your SysAid Account ID.

       ![SysAid Account ID fill in](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-e239c74b891304babe501cb22640618f572efb11%2Fsysaid-image2.png?alt=media)
   * Make sure to note down the response **clientId**, **clientSecret** and the **applicationName** for further use.

     ![Application Authentication Credentials](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-887405a32a9afa35bff0a356a8f8beb225f3c0dc%2Fsysaid-image3.png?alt=media)

***

## Step 2: Gather Service Record Details

1. **Service Record Type - Incidents**
   * The service records of type ***Incidents*** are created with each alert.
   * The default ***Incident*** type Service Record ***Template*** is used, if you need to change that, please note the ***templateId*** need to be used.
   * Please note the following data related to the above ***templateId***,
     * ***requestUser***
     * ***assignedGroup***
     * ***primaryCategory***
     * ***secondaryCategory***
     * ***secondaryCategory***
     * ***thirdLevelCategory***
2. **Alternative Method**
   * Alternatively, you can send an existing Incident type Service Record ***ID*** to be used as the template.

***

## Deliverables

Please email to <support@threatdefence.com>:

1. **Application Credentials**:
   * Please make sure the following credentials are noted in the email.
     * x-sysaid-accountid
     * applicationName
     * clientId
     * clientSecret
2. **Incident Service Record Details**:
   * Please make sure you include the details or a valid service record ID
   * If including the details,
     * requestUser
     * assignedGroup
     * templateId
     * primaryCategory
     * secondaryCategory
     * secondaryCategory
     * thirdLevelCategory
   * If including a valid Incident Service Record ID,
     * The ID of the service record.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/platform-management/alerting/sysaid.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.