SigSentrySigSentry

Zendesk

Connect Zendesk so incoming tickets are auto-triaged and high-severity ones get full SigSentry analysis

The Zendesk integration uses OAuth for authentication, registers a webhook for ticket.created events, and posts triage / analysis results back as internal notes or public replies.

Prerequisites

NeedNotes
Zendesk subdomaine.g. acme.zendesk.com
Admin permissionTo install the OAuth app
At least one project in SigSentryWith log sources connected

Setup walkthrough

Click "Install Zendesk" in SigSentry

Go to Project → Support Desk → Connect platform → Zendesk. You'll be redirected to your Zendesk instance's OAuth consent flow.

Authorize on Zendesk

You'll see Zendesk's OAuth screen. SigSentry requests these scopes:

ScopeWhy
tickets:readRead ticket subjects, descriptions, custom fields
tickets:writePost internal notes and public replies
webhooks:writeRegister and manage the webhook for new tickets

Click Allow.

Webhook registers automatically

After OAuth, SigSentry registers a webhook on your Zendesk instance that fires on conditional_ticket_events (specifically, ticket creation). You don't need to configure anything in Zendesk's UI — the webhook lives under Admin Center → Apps and integrations → Webhooks if you want to inspect it.

Return to SigSentry

The connection appears under Project → Support Desk → Connected platforms.

Configure the binding

Click Configure on the new Zendesk binding. Set:

FieldValue
Result posting modeinternal, public, or both
Auto-analyze thresholddisabled, critical, high, medium, low
Default time bufferHours of log history to query when the ticket doesn't specify a time (default: 2)
Custom field mappingMap Zendesk custom field IDs (see below)
Public reply templateCustomize the customer-facing message (optional)

Test with a real ticket

Have someone create a test ticket in Zendesk. Within seconds, you should see an internal note appear with the triage result. If the severity meets your auto-analyze threshold, a second note follows with the full analysis.

Custom field mapping

If you want SigSentry to populate Zendesk custom fields with triage data (e.g. set severity field to high, set affected_service to checkout-api), map field IDs in the binding configuration:

SigSentry fieldMaps to Zendesk custom field ID
severitye.g. 360001234567
affected_servicee.g. 360002345678
analysis_urle.g. 360003456789

Find the IDs under Admin Center → Objects and rules → Tickets → Fields. Click a field; the ID is in the URL.

When SigSentry processes a ticket, the corresponding custom field is updated alongside the internal note.

Public reply template

If posting mode includes public, the public reply uses a customizable template. The default:

Hi {{requesterName}},

Thanks for reporting this. Our team is investigating and will follow
up shortly.

— SigSentry Auto-Triage

Available variables:

VariableSubstitutes
{{requesterName}}The ticket requester's name
{{ticketId}}The ticket's numeric ID
{{severity}}Triage severity (e.g. "high")

Customize per binding. Internal notes always use the full diagnosis — the template only applies to public replies.

Disconnecting

Click Disconnect on the Zendesk binding in SigSentry. This:

  1. Removes the webhook from your Zendesk instance
  2. Revokes SigSentry's OAuth token
  3. Marks the binding inactive in SigSentry

The OAuth app remains in your Zendesk admin's installed apps — remove it from there if you want to fully clean up.

Troubleshooting

SymptomLikely cause
No internal note appearingWebhook didn't register; check Admin Center → Webhooks
Webhook fires but no triageTriage may have failed silently; check the SigSentry audit log
Public reply not postingPosting mode is internal; switch to public or both
Custom field not updatingField ID typo, or the field is restricted to certain ticket types