Currently, there is no correlation between emails which go out other that the email subject. Any follow up emails (completed, remediation accepted etc), simply have the original subject with "Re: " in front of it. While it is possible to match that in some PSAs, it would be much easier if all communications included a standard key ID that correlates that communication. Subject matching becomes a problem if the same device/user has multiple incidents in a short period of time.

This goes for EDR and ITDR at the very least, but I'm assuming other notifications have the same problem.

Using the API guarantees the additional information lands on the correct ticket, but API integration isn't always the possible solution.

Getting an email which just says "This incident has been resolved" isn't very helpful.