Where tickets come from
Customers raise tickets in the customer portal: a question, a report of something suspicious, or a request. Analysts can also open a ticket to a customer from the console. Each ticket is a thread on one organization.
Working tickets
Tickets in the console lists threads across your scope and updates live. Reply from the thread; the customer sees the reply in the portal and gets an email. Link a ticket to a case; the customer then sees the case's title, severity and status on the ticket, not the investigation.
Closing
Either side can close a ticket. A closed ticket stays readable but takes no more replies; the customer opens a new one to continue. Every message and state change is audited.