The time a ticket opened is not when it started

The ticket clock is the filing

A case system stamps a created time when someone opens the ticket. That stamp says when the record started. It does not say when a log line, a report, or a backup was made.

If the created time is missing from the export, write “ticket time not in the export.” Do not copy an evidence time into that field.

Evidence has its own times

A sign-in, a mail receipt, or a user report can be earlier or later than the ticket. Each of those is its own timestamp, with its own source. The earliest one you have cited is the earliest you have cited. It is not automatically the start of everything.

Do not slide evidence times so they match the ticket. The gap is part of the note.

What to write down

File the ticket id, the created time, and each evidence time with its source. A sentence that says “started” has to name which clock. “Ticket opened” is not that sentence.

Lab: a ticket at 14:00 and a report at 09:12

Lab ticket IR-2026-014 was created at 14:00 UTC. The attached user report says the person saw the odd prompt at 09:12 UTC. A draft says the incident started at 14:00 because that is when the case exists.

The note quotes 14:00 as the ticket time and 09:12 as the report time. The case did not begin at 14:00 in the sense of the report. No other log has been attached, so no earlier machine time is claimed.

ticket: IR-2026-014
created: 2026-11-02T14:00:00Z
user report time: 2026-11-02T09:12:00Z
other logs attached: none
write: two clocks
not: the incident started at 14:00