Overview
RansomLeak connects Freshservice to targeted security awareness training. When a security-relevant ticket is created or updated, the app assigns a short, interactive RansomLeak module to the affected employee, then records the assignment and its completion on the ticket as notes.
Each security ticket becomes a teaching moment for the right person, with the evidence on the ticket your agents already work from. These are the tickets it is built for:
- Phishing reports
- Security incidents
- Risky access requests
- Onboarding tickets
You decide which ticket categories trigger training and which module each one assigns. The app acts only on the values you map, so nothing fires on routine tickets.
Requirements
- Freshservice, Freshservice for Business Teams, or Freshservice for MSPs
- Admin permission to install Marketplace apps
- A RansomLeak integration API key
- A Freshservice API key
The RansomLeak key is a Bearer token that begins with rl_. Create it in your
RansomLeak account, or email support@ransomleak.com and
we will issue one for your account.
The Freshservice API key lets the app look up the requester and post notes on the ticket. Where your plan does not allow agent API keys, an API-only integration user has its own key and does not take an agent license.
Every employee who should receive training needs a RansomLeak account under the same work email. The app assigns training to existing learners and never creates users.
Installation
The app is free on the Freshworks Marketplace, carries the Verified by Freshworks mark, and runs on Freshworks' own serverless platform. There is no infrastructure for you to host or maintain.
-
Open RansomLeak Security Awareness Training on the Freshworks Marketplace and select Install. You can also find it in Freshservice under Admin → Apps → Get more apps.
-
Choose your Freshservice account and confirm the installation.
-
The installation page opens straight away. Fill it in as described in the next section and select Install to finish.
The app has no agent-facing screen. Once installed, it listens for ticket events in the background and does its work through notes on the ticket.
Configuration
Everything is set on the app's installation page. There are three steps.
-
Connect your accounts. Enter your RansomLeak API key, your Freshservice domain (for example
acme.freshservice.com), and your Freshservice API key. Then select Load my categories & modules. The page will not save until RansomLeak has accepted the key, so a mistyped key cannot leave you with an app that silently does nothing. -
Set the behaviour. Choose whether training is mapped by ticket Category (the default) or Type, and whether the app's notes are Private (the default) or Public.
-
Map tickets to modules. Each rule pairs a value from your own Freshservice account with a module from your RansomLeak catalogue, both picked from dropdowns. A starter set built on stock Freshservice categories is filled in for you to edit.
| Who gets trained | When to use it |
|---|---|
| Requester (default) | The person who raised the ticket is the affected employee, as with a self-reported phishing email. |
| Affected-user field | Name a ticket field that holds the at-risk person's email. Use it when an agent or manager raises the ticket on someone else's behalf. |
Saved API keys are never shown back on the installation page. When you change any setting later, enter both keys again before saving.
How it works
Once a category or type is mapped, the flow runs on its own. Nothing is queued for an agent to action by hand.
A ticket is created or updated with a mapped category or type.
-
The app resolves the affected employee's work email from the requester or the affected-user field you named.
-
It calls the RansomLeak assignment API over TLS and adds an assigned note to the ticket, so the trail starts where your agents already look.
The employee completes the short module in RansomLeak.
-
RansomLeak calls back, and the app adds a completed note with the date and whether the employee passed.
Each ticket gets one assignment. Later updates to the same ticket never assign the module twice, and a re-delivered completion never posts a second note.
Permissions and data handling
The app makes a short, fixed list of calls, and each one has a single job. Nothing else leaves your Freshservice account.
| Call | Why the app makes it |
|---|---|
GET /api/v2/requesters/{id} | Resolve the requester's work email. |
POST /api/v2/tickets/{id}/notes | Add the assigned, completed, or could-not-assign note to the ticket. |
GET /api/v2/ticket_form_fields | List your ticket categories and types for the mapping, at install only. |
| RansomLeak assignment API | Assign the mapped module, and at install, list your RansomLeak modules for the dropdowns. |
- Egress only to app.ransomleak.com and your Freshservice domain
- Reads only ticket id, category or type, and work email
- Never stores the ticket body
Both API keys are held as secure installation parameters in the Freshworks platform's secret store. For how RansomLeak handles data, see the privacy policy and the security and compliance page.
Troubleshooting
Once a ticket matches your mapping, the app never fails quietly. If it cannot assign the module, it adds a note to the ticket saying why.
| Symptom | Fix |
|---|---|
| No note at all on the ticket | The ticket's category or type is not in your mapping. Unmapped tickets are skipped without a note on purpose. The app's Logs tab names the value it saw. |
| Note says the requester has no RansomLeak account | Add the employee to RansomLeak under the same work email, then update the ticket again. |
| Note says the module is unavailable | The mapped module's course is disabled in your RansomLeak account, or the module no longer exists. Enable the course or pick another module in the mapping. |
| Completion is not on the ticket | Completion writes back after the employee finishes the module. Check the ticket's notes, including private notes if you chose that visibility. |
Need a hand?
Email support@ransomleak.com and we will help you connect Freshservice to your tenant.