Send every IT ticket to the right resolver group

Fields

• Ticket short description
• Ticket description, with any replies from the user
• Channel (portal, email, chat, phone note)

Questions

1. Which resolver group should own the fix or fulfilment for this ticket? Choice

   Pick the one group that fixes the fault or fulfils the request, using the routing rules in the context. When the ticket raises more than one problem, pick the group for the one that stops the user working. A security sign mentioned in passing does not make Security operations the group.

   • End-user devices Laptops, desktops, monitors, docks and keyboards, and the software installed on one person's device.
   • Identity and access Passwords, MFA, locked or disabled accounts, sign-in failures across several systems, and restoring access a user already had.
   • Email and collaboration Mailboxes, calendars, Teams, SharePoint and OneDrive, when the user can sign in but the service misbehaves.
   • Network and VPN Wi-Fi, the wired network, VPN and internet connection at a site or at home, when the connection is at fault.
   • SAP Errors, slowness, data problems and roles inside SAP, when the user can sign in.
   • Plant floor systems The production execution system, line terminals, handheld scanners and label printers on the plant floors.
   • HR and payroll systems The HR, payroll and time recording systems.
   • Office printing Office printers, scanning and copying.
   • Telephony Desk phones, company mobiles and phone lines.
   • Security operations Tickets whose point is to report a security event: a phishing email, a malware warning, a lost or stolen laptop or phone holding company data, or an account the user believes someone else is using.
   • Service desk How-to questions and simple requests the service desk answers on first contact, with nothing broken and nothing for another group to supply.

2. Is this ticket an incident, a service request or a question? Choice

   Judge what the user needs, not the form they used. A ticket that reports a fault and also asks for a reset is an incident.

   • Incident Something that worked has stopped working or got worse.
   • Service request Asks for something new: access, equipment, software, a change, or information from a system.
   • Question Asks how to do something, with nothing broken and nothing to supply.

3. Does the ticket say that more than one person has the problem? Yes / No

   Count a team, a site, a department, "everyone" or "all of us", or colleagues named as having the same problem. Yes: The ticket says or clearly implies that more than one person has the problem. No: Only the writer is affected, or the ticket says nothing about anyone else.

4. Does the user say they cannot do their work at all because of this problem? Yes / No

   Judge from what the user says about their work, not from how serious the fault sounds. Yes: The user says, or the ticket makes plain, that they cannot do their job or a key task right now. No: The problem is slow, awkward or has a workaround, or the ticket asks for something new with no work stopped.

5. Does the ticket concern one of the business-critical services named in the context? Yes / No

   Use only the list of business-critical services in the context. Yes: The ticket is about one of those services, or about a problem that stops the user reaching one of them. No: The ticket concerns no service on that list.

6. Does the ticket describe a possible security event, even in passing? Yes / No

   Read the whole ticket, including remarks made in passing. Count: clicking a suspicious link or opening an unexpected attachment; entering a password on an unfamiliar page; sign-in or MFA prompts the user did not start, whether they were approved or denied; alerts about sign-ins the user did not make; a lost or stolen device; pop-ups demanding payment or files that suddenly changed or disappeared; someone asking the user for their password or a code. A user who simply forgot a password is not a security event. Yes: At least one such sign appears, however briefly. No: No such sign appears.

7. Does the ticket ask for a password reset, an MFA reset, an account unlock or a new sign-in device? Yes / No

   Count a request for the writer or for someone else, in any words. Do not judge whether the person is who they say they are; the context says code runs the identity check before any reset. Yes: The ticket asks for a password or MFA reset, an account unlock, or a new phone or device to be set up for sign-in. No: No such request appears.

8. Does the ticket ask for new or wider access to a system, folder, mailbox or data? Yes / No

   Restoring access the user already had, such as unlocking an account, is not a new access request. Yes: The ticket asks for access the person does not have today, for themselves or for someone else. No: No new or wider access is asked for, including when the ticket only asks for a reset, an unlock or access the user already had.

9. Does the user say what they have already tried to fix the problem? Yes / No

   Count restarting, signing out and back in, using the password reset page, trying another device or network, or any other step the user says they took. Yes: The user says they tried at least one step. No: The user mentions no step they took.

10. Does the ticket give enough detail for the resolver group to start without going back to the user? Yes / No

    Enough means what is wrong or wanted, which system or device, and, for a fault, what the user sees, such as an error message. Yes: A resolver could start work from the ticket as written. No: The resolver would have to ask the user what is wrong, where, or which system.

Lens columns

assignment_group, assignment_group_probability, ticket_kind, ticket_kind_probability, many_users_affected, many_users_affected_probability, work_stopped, work_stopped_probability, business_critical_service, business_critical_service_probability, security_concern, security_concern_probability, credential_reset_requested, credential_reset_requested_probability, access_request, access_request_probability, already_tried_fix, already_tried_fix_probability, enough_detail, enough_detail_probability