Ticket Triage

Ticket Triage Best Practices

Overview

Ticket triage is the critical first step in service delivery. Proper triage ensures tickets are correctly prioritized, categorized, and routed to the right team for efficient resolution. These practices apply across all PSA platforms.

Anti-triggers

This is a shared skill: it owns the judgement — how to decide priority, category, owner, and first response. It does not know any platform's API. The moment the task is to read or write a ticket, load the vendor skill, which carries the real status values, priority enums, and queue IDs.

• Reading, creating, or updating a ticket — use autotask-tickets, connectwise-psa-tickets, halopsa-tickets, syncro-tickets, atera-tickets, freshdesk-ticketing, or ninjaone-tickets.
• What a specific platform's priority or status values mean — those are vendor enums, not general practice; use that vendor's ticket skill.
• Pulling device, asset, and change context onto the ticket — use shared-skills-incident-correlation.
• A monitoring alert that has not become a ticket yet — use the RMM's alerts skill, such as ninjaone-alerts or datto-rmm-alerts.

The Triage Process

Step 1: Initial Assessment

Within 2-5 minutes of ticket receipt:

1. Read the full ticket - Title, description, any attachments
2. Identify the reporter - Is this an authorized contact?
3. Determine scope - Single user, multiple users, entire site?
4. Check for urgency indicators - VIP, production down, security issue?

Step 2: Duplicate Detection

Before proceeding:

1. Search open tickets for same company
2. Look for similar issues in last 24-48 hours
3. Check for related alerts from monitoring

If duplicate found:

• Link to existing ticket
• Notify user their issue is being tracked
• Close or merge as appropriate

Step 3: Priority Assignment

Use impact and urgency to determine priority:

Impact Assessment

Urgency Assessment

Step 4: Categorization

Assign issue type and sub-type:

Common Categories

Step 5: Routing

Route to appropriate queue/team:

Step 6: Initial Response

Send acknowledgment within SLA window:

Good initial response includes:

• Confirmation ticket received
• Expected response time
• Any immediate steps user can take
• Ticket number for reference

Example:

Thank you for contacting support. We've received your ticket (#12345) regarding email connectivity issues.

A technician will be in touch within 2 hours per your service agreement.

In the meantime, please try restarting Outlook and let us know if that resolves the issue.

Priority Guidelines

Critical Priority (P1)

Criteria:

• Complete business outage
• Security breach in progress
• Production systems down
• Data loss occurring

Response: Immediate acknowledgment, active work begins immediately

Examples:

• Server down affecting all users
• Ransomware detected
• Email system outage
• Phone system down

High Priority (P2)

Criteria:

• Major productivity impact
• Multiple users affected
• Executive or VIP request
• Time-sensitive business need

Response: Within 1 hour

Examples:

• Department-wide application failure
• CFO laptop issue during quarter close
• VPN down for remote team
• Backup failure

Medium Priority (P3)

Criteria:

• Single user or small group affected
• Workarounds available
• Non-critical systems

Response: Within 4-8 hours

Examples:

• Application running slowly
• Non-critical printer offline
• Single user email issue
• Software installation request

Low Priority (P4)

Criteria:

• Minimal impact
• Enhancement requests
• Scheduled work
• How-to questions

Response: Within 24-48 hours

Examples:

• Password reset
• Training request
• Feature question
• Scheduled software install

Red Flag Indicators

Escalate Immediately

• "Security" or "breach" mentioned
• "Everyone" or "all users" affected
• "Down" or "outage" mentioned
• Executive or VIP reporter
• Financial systems involved
• Compliance/audit mentioned

Check Contract Status

• First ticket from company
• Company marked inactive
• No contract visible
• Billing disputes mentioned

Potential Phishing

• Urgent wire transfer requests
• Password reset requests via email
• Suspicious sender addresses
• Links to unknown sites

Documentation During Triage

Record in ticket notes:

1. Impact summary - Who/what is affected
2. Triage decision - Why this priority/category
3. Initial steps taken - What you verified/checked
4. Next actions - What needs to happen

Example triage note:

Triage Note:

• Impact: Single user, Outlook not loading
• Scope: User's workstation only, other apps working
• Priority: Medium - user can use webmail as workaround
• Category: Software > Application > Microsoft Outlook
• Route: Service Desk
• Initial check: Confirmed user credentials working, O365 service healthy
• Next: Remote session to troubleshoot Outlook profile

Common Triage Mistakes

Avoid These Pitfalls

1. Over-prioritizing - Not everything is Critical
2. Under-categorizing - Be specific, not generic
3. Skipping duplicate check - Creates confusion and double work
4. No initial response - User thinks they're ignored
5. Insufficient information - Don't escalate without details
6. Wrong routing - Creates unnecessary handoffs

Quality Triage Checklist

• Read full ticket details
• Checked for duplicates
• Verified reporter authorization
• Assessed impact and urgency correctly
• Assigned appropriate priority
• Categorized specifically
• Routed to correct queue
• Sent initial response
• Documented triage decision

Metrics to Track

Related Skills

• Vendor-specific ticket management skills
• MSP Terminology