IT Ticket Triage

Turn a pile of incoming tickets into a triaged, prioritized queue. Joy reads each ticket, categorizes it, assigns a priority from your SLA rules, suggests the right queue or owner, and flags the ones that look like a security incident or a duplicate, so you route with a clear picture instead of sorting by hand.

For IT Help Desk Leads Support Dispatchers Security-Conscious IT Teams Small IT Shops
Sample prompt to Joy's Assistant

Here's a batch of incoming IT support tickets: [paste the tickets]. Using our SLA priority rules, triage each one — categorize it as hardware, access, network, software, or security; set a priority; suggest the queue or owner it should route to; and flag anything that looks like a security incident or a duplicate.

What it can look like

An illustrative example. Your output will reflect your own sources, data, and prompts.

Here's a batch of incoming IT support tickets: INC-4471 laptop won't power on after the overnight update; INC-4472 the whole Finance team can't reach the payroll system; INC-4473 locked out of Salesforce and need a password reset; INC-4474 I got an email from the CEO asking me to buy gift cards; INC-4475 Outlook crashes every time it opens; INC-4476 still can't get into Salesforce. Using our SLA priority rules, triage each one — categorize it as hardware, access, network, software, or security; set a priority; suggest the queue or owner it should route to; and flag anything that looks like a security incident or a duplicate.

I've triaged all six tickets against the SLA priority rules in your Knowledge Center. Each one has a category, a priority, and a suggested queue, and I've flagged the two that need a closer look before anything gets routed, a possible phishing incident and a likely duplicate.

Morning ticket triage: proposed

Batch: 6 incoming tickets
SLA priority rules: P1 critical / P2 high / P3 normal / P4 low
Triaged: July 23, 2026

Two of these should jump the normal queue. INC-4474 reads like a gift-card phishing attempt impersonating the CEO, so I’ve marked it a security incident, and INC-4472 is a full payroll outage for the Finance team. Both come out P1 under your rules; the rest are P3 or lower.

TicketCategoryPrioritySuggested queue / ownerNote
INC-4471 — Laptop won’t power on after the overnight updateHardwareP3Desktop SupportSingle user; standard turnaround.
INC-4472 — Whole Finance team can’t reach the payroll systemSoftwareP1Infrastructure on-callTeam-wide outage before a pay run — treat as critical.
INC-4473 — Locked out of Salesforce, need a password resetAccessP3Identity & AccessRoutine reset; verify identity first.
INC-4474 — Email from “the CEO” asking me to buy gift cardsSecurityP1Security teamLooks like gift-card phishing / social engineering — flagged as a possible incident.
INC-4475 — Outlook crashes every time it opensSoftwareP3Desktop SupportSingle user; likely a profile or add-in issue.
INC-4476 — Still can’t get into SalesforceAccessP4Identity & AccessSame requester and system as INC-4473 — likely a duplicate.

Where I’d point you first: INC-4474 to the Security team. A gift-card request that spoofs an executive is a common social-engineering play, and the sooner someone confirms whether the employee acted on it, the better. INC-4472 is the other P1 — payroll is down for the whole Finance team, so it sits with Infrastructure on-call ahead of the individual issues. Everything else is P3 or lower; INC-4476 looks like the same person re-opening INC-4473, so it can be merged rather than worked twice. Nothing here is routed yet — this is the proposed triage for you to confirm and send on.

Want me to draft the security incident note for INC-4474 so you can hand it to the Security team, or write a short shift-handoff summary of the P1s for the next on-call?

From an unsorted pile to a routed queue

IT Ticket Triage takes a batch of incoming tickets and turns it into a sorted queue. Joy, the JoySuite assistant, reads each ticket, categorizes it, sets a priority against your SLA rules, and names the queue or owner it should route to, so the pile arrives already organized.

  1. Give Joy the tickets

    Paste the batch of incoming tickets, or drop in an export from your help desk. Subject lines and a sentence of detail each are enough; rough and out of order is fine.

  2. Say how to triage them

    Ask Joy to categorize each ticket, set a priority from your SLA rules, suggest a queue or owner, and flag anything that looks like a security incident or a duplicate. If you don't spell out the rules, Joy uses the ones in your Knowledge Center.

  3. Review the triage

    Get the batch back as a sorted table with a category, priority, and suggested owner on each ticket, and the ones that need a closer look flagged. Check the calls against how your queue actually behaves.

  4. Route it where you work

    Adjust anything with a quick follow-up, "bump the payroll outage to P1" or "send the printer tickets to Field Support," then copy the triaged queue into your ticketing tool and route it. Joy sorts; you send.

  5. Make it one click for your team

    Save this ask as a custom command on the assistant your team already uses, so anyone can run it in one step.

Make it yours

Categorized on Arrival

Every ticket is sorted into hardware, access, network, software, or security, so the queue lines up with how your teams are split.

Priority from Your SLA

Joy applies your own SLA rules, so a team-wide outage lands at P1 and a routine reset at P3, instead of everything sitting at the same level.

Security Incidents Flagged

Tickets that read like phishing, social engineering, or a breach get pulled out and marked, so they don't wait in line behind a password reset.

Duplicates Caught

When two tickets look like the same issue or the same requester, Joy flags the pair, so you merge them rather than working both.

On-Call Handoff Summary

Turn the open queue into a short shift-handoff note, so the next on-call sees what's hot and what's already routed.

Security Incident Note

Take a flagged ticket and draft the incident note your Security team needs, with what was reported and what to check first.

Weekly Ticket Themes

Run a week's batch and ask Joy which categories keep recurring, so you can see where a fix or a doc would cut the volume.

Requester Reply Draft

For the tickets you can answer on the spot, draft the reply to the requester so you close the quick ones without a round trip.

Frequently Asked Questions

What does IT ticket triage do?

It turns a batch of incoming tickets into a sorted queue. You give Joy the tickets and your SLA rules, and it categorizes each one, sets a priority, suggests the queue or owner it should route to, and flags anything that looks like a security incident or a duplicate. You review the triage and route the work.

Does Joy route or close the tickets itself?

No. Joy proposes the triage, the category, priority, suggested owner, and any flags, and you confirm and route. The sorting is done for you; the action in your ticketing tool stays in your hands. Where a connector supports writing back, you decide what actually moves.

How does it set the priority?

From your own SLA rules. If your tiers put a team-wide outage or a security incident at P1 and a routine reset at P3, Joy applies that consistently across the batch. When the rules live in your Knowledge Center, it uses them; otherwise you can spell them out in the ask.

Can it catch a security incident hiding in the queue?

That's a main reason to run it. A ticket that reads like phishing, a gift-card scam, or social engineering can look routine in a busy queue. Joy pulls those out and flags them so they don't wait behind a password reset, and you decide how to escalate.

How does it find duplicates?

Joy compares the tickets in the batch, and any recent context you give it, for the same requester, system, or symptom. When two look like the same issue, it flags the pair so you can merge them instead of working both. You make the final call on whether they're really the same.

Related Recipes

IT & Security

IT Support Q&A

Employees get instant answers to common IT questions from your documentation.
IT & Security

IT Service Dashboard

Track ticket volume, resolution time, and satisfaction at a glance.
IT & Security

Data Handling Scenarios

Practice proper data handling in realistic security simulations.

Ready to walk into a triaged queue instead of a pile?

Join the waitlist and be first to try this workflow when JoySuite launches.

Join the Waitlist Browse All Recipes