Hi,
We’re new to using RTIR and I’m trying to figure out how to keep service owners informed while system admins are working on an incident. The challenge is that Incident Reports are created by automated emails sent by monitoring systems.
Here’s what I think I want:
1 - noreply@sysmon.com sends an email with subject “Widget site is down” which creates an Incident Report
2 - RT automatically adds group “Widget owners” as CC
3 - sysadmin1 sees the IR, confirms it’s an issue, replies, and opens an Incident; Widget Owners get an email from sysadmin1 saying there’s an issue
4 - sysadmins1-4 investigate, countermeasure, and work on the issue, updating the incident with comments, which only the admins see. When they discover something noteworthy for the Widget Owners, they create a reply; Widget Owners get an email (This is where I think I’m wrong - I can’t seem to CC “Widget Owners” on an Incident, only an IR)
5 - sysadmins resolve the issue and close the incident; Widget Owners get a notice that the Incident is resolved
One catch, I don’t know if I want noreply@sysmon.com to receive emails along with CCs. I might want to turn off notification to Requestor/Correspondent (modify the corresponding scrip, right?)
What’s the easiest, most effortless way for ticket owners/admins to include or exclude service owners from incident communications? Do they have to reply to an IR for correspondents/CCs to be notified?
Thanks!