Review tickets before they close, and control how new tickets get made
Settings > Service Desk's Ticket Review and Ticket Rules pages, plus the Elise Auto-Close and Ticket Evaluation controls they point to on AI Assistant.
What you will have
- Turn on Ticket Review and see exactly who is allowed to close a Resolved ticket afterward.
- Set how many days a Resolved ticket waits before it closes itself.
- Read Elise Auto-Close from Ticket Review's own read-only mirror, then find where it is actually edited.
- See who is notified on a low ITSM score, and what the three Low Score Actions do.
- Read the six-step pipeline that turns an inbound email into a ticket.
- See why a system rule and an integration-owned rule both refuse a Delete button.
- Add a rule with a Stop on match flag and an entity extractor.
Why it works this way
Elise Auto-Close and its minimum score are edited on AI Assistant > Actions & Automation, not on Ticket Review. Ticket Review only shows a read-only mirror of their current value, with a link to the page that actually saves them.
The ITSM evaluation fields that decide who sees a score and what a low score does - Show Evaluation to Technicians, Notify Tech on Evaluation, Low Score Threshold, Low Score Action - live on a different settings page entirely, AI Assistant > Ticket Evaluation, not on Ticket Review.
Turning on Ticket Review changes wording elsewhere in the product: the ticket reply composer's own Close on send switch relabels itself Resolve on send, because a tech can no longer close a ticket directly once review is required.
A system rule and a rule created by connecting an integration are refused a Delete button for different reasons - one is a platform template, the other is owned by that integration's own lifecycle - but the same code path denies both the same way.
Steps
Open Settings > Service Desk > Ticket Review and read the Ticket Review toggle.
Off by default on this tenant. Turning it on requires supervisor approval before a ticket moves from Resolved to Closed, instead of letting the assigned tech close it directly.
Open Settings > Service Desk > Ticket Review and read the Ticket Review toggle. Set Auto-close timeout (days).
Once Ticket Review is on, a daily check promotes any ticket still sitting in Resolved after this many days, with no reviewer action, to Closed. Defaults to 7. Leave it blank to never auto-close this way.
Set Auto-close timeout (days). Read Closer Permission Groups.
Checking a staff permission group here lets its members close a Resolved ticket, on top of Owners, who always bypass and can close one regardless of group membership. The list of groups is pulled from Team > Staff Roles; none are checked by default on this tenant.
Read Closer Permission Groups. Read Pod Leaders Can Close.
On by default. When on, a member marked Can review tickets on the ticket's owning pod can close it, even without a Closer Permission Groups grant.
Read Pod Leaders Can Close. Scroll to Managed elsewhere and read the Elise Auto-Close row.
Ticket Review shows Elise Auto-Close and Elise Auto-Close Minimum Score as a read-only mirror - Off and 4 on this tenant - each with an Edit in AI Assistant > Actions & Automation link. The real, editable controls live on that page, not here.
Scroll to Managed elsewhere and read the Elise Auto-Close row. Follow that link to AI Assistant > Actions & Automation and open the Auto-Close card.
Elise Auto-Close is off by default. When turned on, Elise closes a Resolved ticket herself, as a system actor, once the ITSM evaluation's overall score meets Elise Auto-Close Minimum Score, defaulted to 4 out of 5, without waiting for a human reviewer. Below that score, the ticket still waits in Resolved.
Follow that link to AI Assistant > Actions & Automation and open the Auto-Close card. Open AI Assistant > Ticket Evaluation and read Show Evaluation to Technicians and Notify Tech on Evaluation.
Both are on by default. Show Evaluation to Technicians puts the evaluation card on a closed ticket for the assigned tech as well as admins; turned off, only admins see it. Notify Tech on Evaluation separately sends an Elise message to the tech when the evaluation finishes.
Open AI Assistant > Ticket Evaluation and read Show Evaluation to Technicians and Notify Tech on Evaluation. Read Low Score Threshold and Low Score Action.
An overall score at or below Low Score Threshold, defaulted to 3, triggers Low Score Action: no action, Flag ticket (the default on this tenant, which just marks the row so it shows up in reports), or Notify manager, which reveals a Notify Manager Role field once picked.
Read Low Score Threshold and Low Score Action. Open Settings > Service Desk > Ticket Rules and read how an inbound email becomes a ticket.
The Ticket Rules card lists a six-step pipeline: forward unwrap, then these parsing rules in sort order (a rule with Stop on match halts the rest), then the client's own Default Ticket Assignee, ticket creation, an optional AI triage pass, and finally the dispatch waterfall. Skip bounces and system email is the one seeded system rule underneath, always numbered 999 and always last.
Open Settings > Service Desk > Ticket Rules and read how an inbound email becomes a ticket. Expand Skip bounces and system email.
A locked notice at the top of its editor reads that it is a system rule and only Active and its order can change, everything else is a locked template. Its footer carries only a Save Rule button, with no Delete anywhere on the row. A rule created by connecting an integration, such as a ThreatLocker elevation-request parser, is refused a Delete button the same way - disconnecting the integration is what removes it instead, and it reactivates automatically if the integration reconnects.
Expand Skip bounces and system email. Click Add Rule and turn on Stop processing further rules on match.
This walkthrough's own example rule, KB walk - example, matches on a Subject contains value built so it can never appear in real mail, so it can never affect a real ticket. Stop on match halts every rule below this one in sort order once it matches; a rule you author can turn this on or off freely, unlike a system rule's own Stop on match, which is locked.
Click Add Rule and turn on Stop processing further rules on match. Save the rule, then reopen it to add a User Matching extractor.
Extractors are configured from the rule's own saved row: reopening it after Create Rule shows User Matching, Company Matching and Asset Matching, each with its own Add. This one is User Matching, matched against email, with Start Tag <*user*> and End Tag <*enduser*> capturing whatever text sits between them in the message.
Note: This walkthrough saved the rule with the extractor in place, reloaded the page to confirm both tags had actually saved, then turned its own Active toggle off and saved again - reloading a second time confirmed it now reads Inactive, so it can never act on real mail.Save the rule, then reopen it to add a User Matching extractor. Know what changes elsewhere once Ticket Review is on.
The ticket reply composer's own Close on send switch relabels itself Resolve on send, and the reply now routes the ticket to Resolved instead of Closed, because a tech can no longer close a ticket directly once review is required. Turn Ticket Review off to restore the old Close on send wording and behavior.
If it did not work
- If a field on Ticket Review, Ticket Rules or Ticket Evaluation will not save, confirm your account has edit access to Settings - a view-only account can read every field on these pages but not save changes.
- If a rule's Delete button is missing, the rule is a locked system rule or was created by connecting an integration; disconnect the integration, or use its Active toggle to turn it off instead of removing it.
Questions this page answers
Who can close a Resolved ticket?
Five kinds of people or processes can close a Resolved ticket. Members of the groups listed under Closer Permission Groups can close it. Pod members marked Can review tickets can close it, when Pod Leaders Can Close is on. Owners always bypass, so they can close it. Elise can close it herself, when auto-close is on and its ITSM score meets the threshold. The auto-close timeout cron closes it too, after the configured number of days.
My "Close on send" button says "Resolve on send" now - why?
When Ticket Review is enabled, "Close on send" is misleading because the tech can't actually close - the reply hands the ticket to a reviewer instead. The label and the underlying transition both swap to Resolved so the action matches the result. Turn off Ticket Review to restore the old "Close on send" behavior.
How does Elise auto-close work?
After every transition to Resolved, the ITSM evaluation cron runs and produces an overall score (1-5). If "Elise Auto-Close" is on AND the score meets the minimum (default 4/5), Elise closes the ticket as a system actor and audits the action. Below the threshold, the ticket sits in Resolved waiting for a human. Coverage estimate: well-run MSPs score 4-5 on 70-80% of tickets, so Elise silently closes the majority and the reviewer only sees the interesting minority.
What does "Auto-close timeout (days)" do?
A daily cron promotes any ticket stuck in Resolved past this many days to Closed, even if no human reviewer or Elise acted. Catches the leftovers - tickets the reviewer never got to and Elise wasn't confident enough to close. Leave blank to disable the timeout entirely.
What is the ITSM evaluation?
When a ticket closes, the closure-summary cron asks the AI to score it (communication 1-5, resolution 1-5, overall 1-5) and classify it by ITSM type (REQUEST / INCIDENT / PROBLEM / CHANGE / TASK). The score lands on TicketEvaluation rows and feeds the CSAT/Elise-auto-close logic.
Should techs see their own evaluations?
When "Show Evaluation to Technicians" is ON, the evaluation card renders on the closed ticket for the assigned tech (in addition to admins). When OFF, only admins see it. Pair with "Notify Tech on Evaluation" to push an Elise message instead - useful for teams where the eval is a coaching tool, not a graded report.
What happens on a low score?
Low Score Threshold (default 3) sets the overall-score cutoff. At or below it, the Low Score Action kicks in: none (do nothing), flag (mark the row so it shows up in reports), or notify_manager (email the role chosen in Notify Manager Role). The Manager Role field only appears when you pick notify_manager.
What are email parsing rules?
Settings → Service Desk → Ticket Rules control how inbound emails become tickets. Each rule matches on sender, recipient, subject, or body text (literal contains, or exact and by-domain for the sender), then applies ticket defaults like priority, board, and auto-tagging. Rules run in sort order and every matching rule applies, unless a rule has Stop on match, which halts the rest.
How does auto-close work?
Auto-close timeout promotes RESOLVED tickets to CLOSED after N days with no action, once Ticket Review is on. Set to blank to disable. Elise Auto-Close goes further: when the ITSM evaluation score is at or above the minimum (default 4), Elise closes the ticket at resolution without waiting for a reviewer. The timeout runs on the auto-close-resolved sweep; Elise Auto-Close runs from the closure-summary evaluation.
What is an email parsing rule?
A rule that matches inbound email (by from / to / subject / body / attachment) and turns it into a ticket with your defaults applied. Use it to fan-out monitoring alerts to the right board, auto-assign known-sender requests, or strip pre/post markers from forwarded mail before saving the ticket body.
What do Extractors do?
Extractors pull structured fields out of the email - most commonly the original sender of a forwarded message. Configure start-tag / end-tag / regex to define what to grab, then map to USER / ASSET / COMPANY so the ticket attaches to the right entity instead of the forwarding inbox.
What is "Stop on match"?
Rules evaluate in sortOrder. When a rule with "Stop on match" matches an email, no further rules run on that message. Use it to short-circuit specialized rules (e.g. a critical-alert rule from your RMM) so the generic catch-all rules don't double-process.
Why can't I delete this rule?
A rule created by connecting an integration (for example, ThreatLocker's elevation-request parser) is owned by that integration's lifecycle, not authored here. Deleting it is refused; disconnect the integration instead, which deactivates the rule without losing its configured tunables. It reactivates automatically if you reconnect. Rules you author yourself have no such restriction.
What is the Ticket Evaluation page for?
This page controls the AI review the assistant runs on every closed ticket. It sets whether techs can see their own scores, and what happens when a ticket scores low.
How do I get notified when a ticket scores low?
Go to Settings → AI Assistant → Ticket Evaluation. Set Low Score Threshold to the score that counts as low. Set Low Score Action to Notify manager. Choose the role in Notify Manager Role. Then save. Setting Low Score Action to Flag ticket instead just marks the ticket, with no notification. No action does neither.
Why can't a technician see their own evaluation scores?
Show Evaluation to Technicians on this page controls that. If it is off, only admins see ticket scores. Techs see nothing, even though scoring still runs, and Notify Tech on Evaluation does nothing either.
Was this helpful?