> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Halo ITSM

> Integrate with Halo ITSM to automatically create and manage tickets from Wirespeed cases and detections

## Prerequisites

In Halo ITSM, you need an API application configured with the **Client Credentials** grant type. To create one:

1. Log in to your **Halo ITSM** instance
2. Navigate to **Configuration** > **Integrations** > **HaloPSA API** > **View Applications**
3. Click **New** to create an application
4. Set **Authentication Method** to `Client ID and Secret (Services)`
5. Set **Login Type** to **Agent** and set **Agent** to **Application Identity**
6. Under **Identity Roles**, select **IT Agent**
7. Grant the application access to the following scopes: `read:tickets`, `edit:tickets`, `read:customers`
8. Copy the **Client ID** and **Client Secret**
9. Save the application

## Connect Wirespeed to Halo ITSM

1. Log in to Wirespeed and navigate to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse)
2. Select **Halo ITSM** and click **Integrate**
3. Fill in the following fields:
   * **Halo Instance URL** — the base URL of your Halo instance (e.g. `https://yourcompany.halopsa.com`)
   * **Client ID** — from the API application created above
   * **Client Secret** — from the API application created above
4. Click **Save**

Wirespeed will verify the credentials by checking access to Teams, Ticket Types, and Categories. If any check fails, the integration will not be enabled — double-check the credentials and scopes.

## Configure Ticket Behavior

After enabling the integration, click **Configure** to set ticket creation preferences:

| Setting                                      | Description                                                                                 |
| -------------------------------------------- | ------------------------------------------------------------------------------------------- |
| **Client**                                   | Halo client to associate with tickets (optional)                                            |
| **Team**                                     | Halo team to assign tickets to                                                              |
| **Category**                                 | Incident category to assign to all tickets (required)                                       |
| **Create Tickets for Standalone Detections** | When enabled, tickets are created for detections that are closed and not part of a case     |
| **Case Ticket Title Template**               | Title template for case tickets. Supports variables like `` `sid` `` and `` `title` ``      |
| **Detection Ticket Title Template**          | Title template for detection tickets. Supports variables like `` `sid` `` and `` `title` `` |

Click **Save** when done.

## Add a Webhook

To have Wirespeed automatically close cases when a ticket is resolved in Halo and sync notes back, set up a webhook:

1. Log in to Wirespeed and navigate to [**Integrations**](https://app.wirespeed.co/settings/integrations) > select your Halo ITSM integration > **Configure**
2. Copy the **Webhook URL** and the **Webhook Secret**
3. Log in to your **Halo ITSM** instance
4. Navigate to **Configuration** > **Integrations** > **Webhooks**
5. Click **New** to create a webhook
6. Paste the **Webhook URL** from Step 2
7. Set **Authentication** to **Sign Request Body with a Secret Key**
8. Set the **Secret** to the **Webhook Secret** from Step 2
9. Configure the signature header name as `x-signature` and set the signing algorithm to `SHA-256`
10. Add the following headers to the signature, in this order: `content-length`, `content-type`, `host`, `x-halo-date`
11. Under **Events**, enable **Ticket Updated by Agent** and **Ticket Updated by User**
12. Save the webhook

<Info>
  The webhook secret is required. Wirespeed verifies the `x-signature` header using HMAC-SHA256.

  Halo should compute the signature from this canonical string:

  ```text theme={null}
  content-length: <content-length>
  content-type: <content-type>
  host: <host>
  x-halo-date: <x-halo-date>
  <raw request body>
  ```

  The resulting HMAC-SHA256 digest should be base64-encoded and sent in the `x-signature` header.
</Info>

## How It Works

* When a Wirespeed case or detection triggers, a ticket is created in Halo as an **Incident** with priority mapped from severity (Critical → P1, High → P2, Medium → P3, Low/Info → P4).
* When a ticket is closed in Halo (status ID 9), the corresponding Wirespeed case is automatically closed.
* Notes added to a ticket in Halo are synced back to the Wirespeed case timeline.