Correlation across tickets is done by memory. A tech notices they have handled three of the same thing this week, or a director notices one building is louder than usual, but only if the same person happened to see all of it.
On a team of three covering a dozen buildings, nobody sees all of it. The signal is already in the ticket data; there is just no one with the time to go looking for it.
Ticket volume is compared against its own 30-day baseline by submitter, by school, by category, and by tag.
Each dimension is measured against its own recent normal, so a busy building is not permanently flagged for being busy.
The multiplier and the minimum count are configurable, so you decide what counts as unusual rather than accepting ours.
It is computed from ticket data on demand. There is no model to train, no agent to deploy, and no extra storage collecting history about your staff.
The value is time-to-root-cause. A cluster of tickets from one building, one category or one person is usually a single underlying cause wearing several costumes: a failing access point, a bad image, a change nobody announced. Seeing the cluster early is the difference between fixing one thing and closing fifteen tickets one at a time.
This reads ticket volume, not your network. It is not intrusion detection, it does not watch traffic or endpoints, and it will not see a problem nobody has filed a ticket about. What it does is stop a pattern that is already in your help desk from waiting on a human to notice it.
Every feature is in every plan, including this one. Set it up yourself in an afternoon, or have us walk you through it.