During a citywide phishing wave, the municipal SOC’s AI proposes merging dozens of near-identical resident-help tickets. Which IR ticket-management use best fits?

AI-assisted duplicate-ticket merging is a high-value incident-response ticket-management pattern when a citywide phishing wave floods the municipal help desk with near-identical resident reports. The AI clusters tickets that share indicators, subject patterns, or payload hashes and proposes consolidating them into a single parent case (or a controlled merge set) so analysts work one investigation trail instead of dozens of fragmented queues. That design works because it reduces analyst thrash, preserves a unified timeline and evidence set, and still requires a human to confirm the merge—so accountability, escalation ownership, and audit history remain intact for civic IR.

AI-suggested duplicate-ticket splits that analysts still confirm fails because splitting divides cases apart rather than consolidating dozens of near-identical reports into one investigation trail, so it increases fragmentation instead of reducing analyst thrash. AI-applied duplicate-ticket merges that analysts still review fails because the AI executes the merge first and leaves analysts to review afterward, removing the required pre-merge confirmation that preserves accountability, escalation ownership, and audit history. AI-suggested duplicate-ticket merges that residents still confirm fails because residents lack SOC context, evidence access, and escalation authority to validate similarity and differing fields; analyst confirmation is required to preserve a unified timeline and civic IR accountability.

Exam caveat: near-duplicate clustering can false-merge distinct incidents that share a template but differ in payload, target group, or impact—analyst confirmation is not optional theater. Operational check: require merge proposals to show similarity rationale and differing fields; keep an immutable link from child tickets to the parent case; and sample merges after each campaign to verify no unique civic reports were collapsed incorrectly.