# Button inside detection to send to specific output (ticketing system)

**URL:** <https://community.limacharlie.com/t/button-inside-detection-to-send-to-specific-output-ticketing-system/156>\
**Category:** Feature Requests\
**Created:** [March 17, 2025, 12:17pm UTC](https://community.limacharlie.com/t/button-inside-detection-to-send-to-specific-output-ticketing-system/156 "2025-03-17T12:17:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michael\_Gilliam](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/michael_gilliam/32/76_2.png) [@Michael\_Gilliam](https://community.limacharlie.com/u/Michael_Gilliam)\
**Post date:** [March 17, 2025, 12:17pm UTC](https://community.limacharlie.com/t/button-inside-detection-to-send-to-specific-output-ticketing-system/156/1 "2025-03-17T12:17:04Z")

</div>

In the web UI, it would be nice to have a button available that allows the user to manually send the detection to a configurable Output or choose from a list of outputs (maybe you can somehow mark one as a favorite). If the detection panel is being used for triage, a common workflow might be that once a detection is determined to be an incident or need further investigation, create a ticket in a ticketing platform (via outbound webhook) - this additional webUI feature could improve that workflow opportunity

---

<div class="post-metadata">

**Author:** ![Dmitri\_Zimine](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/dmitri_zimine/32/45_2.png) [@Dmitri\_Zimine](https://community.limacharlie.com/u/Dmitri_Zimine)\
**Post date:** [March 20, 2025, 9:36pm UTC](https://community.limacharlie.com/t/button-inside-detection-to-send-to-specific-output-ticketing-system/156/2 "2025-03-20T21:36:30Z")

</div>

Hi Michael, thanks for sharing.  
If you wanted to make all detections produced by this D&R rule in an output, you could have added an `output` action in the rule that produced it.  
(_note to LC - we can add “go to Rule” link to help jump from Detection to rule_)  
But looks like you’re looking to have an analyst decide on a very specific detection instance, and add it to a ticketing system, correct?

---

<div class="post-metadata">

**Author:** ![Michael\_Gilliam](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/michael_gilliam/32/76_2.png) [@Michael\_Gilliam](https://community.limacharlie.com/u/Michael_Gilliam)\
**Post date:** [March 24, 2025, 7:58pm UTC](https://community.limacharlie.com/t/button-inside-detection-to-send-to-specific-output-ticketing-system/156/3 "2025-03-24T19:58:41Z")

</div>

Correct - just from a workflow perspective - not all rules will generate detections that are actionable (some will be FP, some will be normal activity). It would be nice to allow an analyst to individually send detections to an output (which would be to a ticketing system)

---

<div class="post-metadata">

**Author:** ![Dmitri\_Zimine](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/dmitri_zimine/32/45_2.png) [@Dmitri\_Zimine](https://community.limacharlie.com/u/Dmitri_Zimine)\
**Post date:** [March 26, 2025, 5:40pm UTC](https://community.limacharlie.com/t/button-inside-detection-to-send-to-specific-output-ticketing-system/156/4 "2025-03-26T17:40:29Z")

</div>

ok, understood, thanks for clarification. Can’t make immediate promises but we explore some ideas on how to achieve it.