For now, I would check out the "Share Notable Event" action in the Actions dropdown per notable event. This produces direct hyperlinks to the notable event with a copy-clipboard option. While not a "ticket number", this link can be distributed in digital-friendly ways: https://server:8000/splunk-es/en-US/app/SplunkEnterpriseSecuritySuite/incident_review?form.srch=rule_id%3DDB9D6F9F-4BFD-4A81-8852-39474DCB9D56%40%40notable%40%405dc87d1d390c9c47b2a7de18d2cc7bc3&earliest=1477325415&latest=1477325417 ... View more