What is the difference between a security alert and a ticket?

• A. An alert is a detected potential issue that requires no action.
• B. A ticket is simply a notification with no assigned work.
• C. Alerts are created after a ticket is opened.
• D. An alert indicates a detected potential issue; a ticket is the assigned work item for investigation and remediation with a status.

Answer: (D)

In security operations, the difference between an alert and a ticket is that an alert is a detected potential issue from monitoring tools, while a ticket is the formal work item created to investigate and remediate that issue. An alert comes from the sensors, such as a SIEM, IDS/IPS, or endpoint monitor, and it provides context like the type of threat, the involved asset, and a severity level. It signals that something noteworthy happened, but it doesn’t assign ownership or track what’s being done about it.

A ticket, on the other hand, is the workflow artifact used to manage the response. It assigns the work to a person or team, records the status (open, in progress, resolved, closed), tracks milestones or due dates, and includes evidence, notes, and remediation steps. The typical path is: an alert is generated and reviewed, and if it requires action, a ticket is opened to coordinate investigation and remediation. The alert remains as the detection signal, while the ticket represents the actual task and progress toward resolution.

Some choices imply that alerts require no action, or that tickets are just notifications with no work, or that alerts come after tickets. Those don’t fit because alerts are the detection signals that may or may not lead to action, and a ticket is specifically the assigned work item with status and accountability to drive remediation.