Prerequisites
In Halo ITSM, you need an API application configured with the Client Credentials grant type. To create one:- Log in to your Halo ITSM instance
- Navigate to Configuration > Integrations > HaloPSA API
- Click New to create an application
- Set Authentication Method to
Client Credentials - Use Login type ‘Agent’ and Agent to log in as ‘Application identity’
- Grant the application access to the following scopes:
read:tickets,edit:tickets - Save the application and copy the Client ID and Client Secret
Connect Wirespeed to Halo ITSM
- Log in to Wirespeed
- Navigate to Integrations > Add Integration
- Select Halo ITSM and click Integrate
- Fill in the following fields:
- Halo Instance URL — the base URL of your Halo instance (e.g.
https://yourcompany.halopsa.com) - Client ID — from the API application created above
- Client Secret — from the API application created above
- Halo Instance URL — the base URL of your Halo instance (e.g.
- Click Save
Configure Ticket Behavior
After enabling the integration, click Configure to set ticket creation preferences:| Setting | Description |
|---|---|
| Team | Halo team to assign tickets to |
| Category | Incident category to assign to all tickets (required) |
| Create Tickets for Standalone Detections | When enabled, tickets are created for detections that are closed and not part of a case |
| Case Ticket Title Template | Title template for case tickets. Supports variables like `sid` and `title` |
| Detection Ticket Title Template | Title template for detection tickets. Supports variables like `sid` and `title` |
Add a Webhook
To have Wirespeed cases closed automatically when a ticket is resolved in Halo, and to sync notes back, set up a webhook:- Log in to Wirespeed
- Navigate to Integrations > select your Halo ITSM integration > Configure
- Copy the Webhook URL and the Webhook Secret
- Log in to your Halo ITSM instance
- Navigate to Configuration > Integrations > Webhooks
- Click New to create a webhook
- Paste the Webhook URL from Step 3
- Set the Secret to the Webhook Secret from Step 3
- Under Events, enable Ticket Updated by Agent and Ticket Updated by User
- Save the webhook
The webhook secret is required. Wirespeed uses HMAC-SHA256 to verify that incoming requests originate from your Halo instance.
How It Works
- When a Wirespeed case or detection triggers, a ticket is created in Halo as an Incident with priority mapped from severity (Critical → P1, High → P2, Medium → P3, Low/Info → P4).
- When a ticket is closed in Halo (status ID 9), the corresponding Wirespeed case is automatically closed.
- Notes added to a ticket in Halo are synced back to the Wirespeed case timeline.

