Integrating Autotask PSA
This article explains how to connect Autotask as a Professional Services Automation (PSA) system in Kaseya MDR.
The Autotask integration controls how alerts are delivered as tickets to Autotask; it does not affect alert ingestion, detection logic, severity, or investigation behavior.
Use this integration when you want alerts generated in Kaseya MDR to be created as tickets in Autotask.
What the Autotask integration is used for
When Autotask is integrated with Kaseya MDR, you can:
-
Create Autotask tickets from Kaseya MDR alerts
-
Control how alerts are routed to Autotask queues, priorities, and issue types
-
Enable or disable ticket creation per organization
-
Route alerts to different Autotask accounts and contacts
The Autotask integration does not:
-
Change which alerts are generated
-
Change alert severity
-
Suppress alerts or investigations
-
Affect SOC response behavior
Before you begin
Before connecting Autotask, ensure the following prerequisites are met in Autotask:
-
A dedicated API user exists for the Kaseya MDR integration
-
The API user has permission to authenticate using the Autotask Web Services API
-
Each Autotask account that may receive tickets has at least one contact
-
A default (catch‑all) account and contact exists for unmapped organizations
Using a dedicated API user is recommended rather than reusing an existing human or integration account.
Creating an API user in Autotask
Please follow these steps:
-
From the Autotask dashboard, navigate to the Admin section in the side navigation menu.
-
Click Resources (Users).
-
Select New API User from the + New drop-down menu.
-
Fill out the required information for the new API user, ensuring that the Security Level is set to API User.
-
Click Generate Key and Generate Secret.
IMPORTANT Be sure to copy both the key and secret, as these will be needed for integrating Autotask with Kaseya MDR.
-
In the API Tracking Identifier section, select SaaS Alerts - Network Security from the Integration Vendor drop-down menu.
-
Unless your business is strictly segregated by line of business, it is advisable to refrain from assigning a Line of Business to an API User.
-
Finally, click Save & Close.
Connecting Autotask in Kaseya MDR
-
In Kaseya MDR, open Settings > PSA & Email.
-
In the PSA section, select Add PSA.
-
Choose Autotask.
Enter the Autotask API credentials created earlier:
-
API Username
-
API Password
If the credentials are valid, the wizard continues to organization mapping.
If validation fails, a message indicates invalid credentials.
After the Autotask credentials are validated, the wizard moves to Account Mapping.
This step is required. The integration cannot be completed until a default PSA account is selected and organization mappings are defined.
Account default (required)
Select a Catch‑All PSA Account. This account is used when a specific Kaseya MDR organization does not have an explicit mapping.
When Attach Contacts to Tickets on Creation is enabled:
-
The selected PSA account must have at least one contact.
-
Kaseya MDR attempts to match a PSA contact using the email address included in the alert.
-
If a matching contact is found, it is attached to the ticket.
-
If no matching contact is found, the ticket uses the default contact for the mapped PSA account.
-
If no contact exists, the wizard displays a validation message and prevents you from continuing.
When Attach Contacts to Tickets on Creation is disabled:
-
Tickets are created without associating a contact.
-
The wizard allows you to proceed even if the PSA account has no contacts.
Mapping PSA accounts to organizations
Use the mapping table to associate Autotask accounts with Kaseya MDR organizations.
You can:
-
Filter PSA accounts by account type, classification, or market segment
-
Map individual PSA accounts to the appropriate MDR organization
-
Assign a specific contact per mapped account (optional)
-
Ignore PSA accounts that should not be available for mapping
Only mapped organizations will route tickets to their corresponding PSA accounts. Unmapped organizations fall back to the catch‑all account.
After completing the required mappings, select Next to continue the wizard.
For conceptual details on how organization mapping works and why it is required, see Connecting data sources and integrations.
In this step, you define the default ticket properties used when Kaseya MDR creates Autotask tickets, along with optional overrides for specific alert types or rules.
Several fields in this step are required. The wizard will not allow you to continue until mandatory defaults are set.
Ticket defaults (required)
Ticket defaults define how all new tickets generated from Kaseya MDR are created in Autotask unless overridden later in this step.
You must configure the following:
-
Ticket Category: The category applied to all new tickets.
-
Ticket Type: The Autotask ticket type used for new tickets.
-
Ticket Status: The initial status assigned to new tickets.
-
Ticket Queue: The service queue where new tickets are placed.
-
Ticket Source: The source value assigned to tickets created by Kaseya MDR.
-
Ticket Subject: The subject format used for ticket creation and ticket grouping.
-
Alert Priority Mapping: How Kaseya MDR alert severities (for example, Critical and Medium) map to Autotask ticket priorities.
These defaults apply globally unless a custom mapping is configured below.
Ticket subject and grouping behavior
The Ticket Subject determines both:
-
The subject line of newly created tickets
-
How subsequent alerts are grouped as notes or activities on existing tickets
Choose a subject format that aligns with how you want related alerts grouped within Autotask.
Note defaults (required)
When Kaseya MDR adds notes to an existing Autotask ticket, these settings control how the note is created.
You must configure:
-
Note Type: The Autotask note type used when adding notes
-
Note Visibility: Who can see notes added by Kaseya MDR
-
Note Title: The title format used for notes
These settings are required even if alerts are grouped into existing tickets.
Custom Issue Type and Sub‑Issue mappings (optional)
You can optionally override the default Issue Type and Sub‑Issue Type for specific cases.
Separate mapping sections are available for:
-
Alert‑based mappings: Override values based on specific Kaseya MDR event types
-
Respond Rule mappings: Override values for alerts generated by specific Respond Rules
-
IOC Rule mappings: Override values for alerts generated by specific IOC rules
When a custom mapping is configured and matches, the custom Issue Type / Sub‑Issue Type is used.
Otherwise, the global defaults defined above are applied.
Leaving these sections empty uses the global defaults for all tickets.
Completion criteria
You can proceed to the next step once:
-
All required ticket defaults are configured
-
Required note defaults are set
-
Any optional custom mappings are either completed or intentionally left blank
This step controls how Autotask agreements/contracts are associated with tickets created by Kaseya MDR and, optionally, how billable user counts are synchronized.
Contract mapping is optional. If no contract functionality is enabled, you can finish the wizard without configuring this step.
Agreement / contract functionality
Use these toggles to enable contract‑related behavior:
-
Add Agreements / Contracts to Tickets: When enabled, the selected Autotask agreement or contract is added to each ticket created for the organization.
-
Sync Billable Users to Contracts / Agreements: When enabled, billable user counts from Kaseya MDR are synchronized to the mapped Autotask agreement on a scheduled basis.
-
User Sync Day: Specifies the day of the month when billable user counts are synchronized to Autotask.
Enabling billable user synchronization does not affect alert creation or investigation behavior. It only updates contract quantities in Autotask.
Contract defaults (conditional)
If Sync Billable Users to Contracts / Agreements is enabled, a Default Contract Service is required.
-
The default contract service is used when user counts are synchronized and no organization‑specific service override is defined.
-
If no default service is selected while synchronization is enabled, the wizard displays a validation message and prevents completion.
If billable user synchronization is disabled, the default contract service is not required.
Contract mapping by organization
Use the Contract Mapping table to associate Autotask contracts with Kaseya MDR organizations.
-
For each organization, you can:
-
Select the Autotask contract to associate with tickets
-
Choose whether the default contract service should be added to that contract
-
Optionally review or override cost and price values (if applicable)
Organizations without a mapped contract will:
-
Still generate tickets (if ticket creation is enabled)
-
Not receive contract association or user count updates
Completion criteria
You can finish the wizard when one of the following is true:
-
Contract functionality is disabled, and no defaults are required
-
or
-
Required toggles are enabled and all mandatory fields (such as Default Contract Service) are configured
Contract mapping affects ticket enrichment and billing alignment only.
It does not:
-
Change alert detection
-
Modify alert severity
-
Affect investigations or SOC workflows
When the integration is completed successfully, Autotask appears in Settings > PSA & Email, and a confirmation message is shown in the upper‑right corner of the interface.
Enabling ticket delivery per organization
After the PSA integration is configured:
-
Ticket creation can be enabled or disabled per organization
-
Organization‑level settings control whether alerts generate Autotask tickets
This allows different organizations to use different ticketing behaviors under the same PSA integration.
Editing the integration
You can edit the Autotask integration at any time to:
-
Update credentials
-
Adjust organization mappings
-
Change ticket parameters
-
Enable or disable contract mapping
Relationship to data sources and alerts
-
Autotask is a delivery integration, not a data source.
-
Data ingestion is handled by integrations such as endpoint, network, and SaaS sources.
-
Alerts are generated based on detection logic and ingested telemetry.
-
Autotask only controls where alerts are delivered after they exist.
For an overview of how alerts are delivered to PSAs and external systems, see Notifications, PSA, and external communications.
Where this fits in the documentation
-
Integrations and Data Sources: Explains where security telemetry comes from
-
Notifications, PSA, and external communications: Explains how alerts are delivered
-
This article explains how Autotask is configured as a PSA delivery target.