How can we track all analysts updating incidents, beyond the latest updater?

[Pukar]

Hi Community,

I am looking for a reliable way to capture Service Desk activity outside of calls, including actioning self-service tickets, updating existing incidents and working through dashboard queues.

What we want to achieve

For a selected date range or shift, we’d like to:

• Identify each team member who updated a ticket, using their name and employee identifier.
• Count distinct tickets actioned by each team member.
• Capture work notes, comments, status changes, reassignments and resolutions.
• Exclude automated or integration-generated updates.

For example, if two service desk team update the same incident, we want to capture both team activity, rather than only the person who made the final update.

Why these matters

Call metrics don’t capture a significant part of our team’s workload, particularly on night shift, when queue management is a primary focus. Leadership wants reliable visibility into this work to support accountability, recognition and future KPI reporting.

Current roadblocks

Our previous reporting attempts have only captured the latest updater, which misses earlier contributions when multiple team member work on the same ticket.

I can access incident records, but I don’t currently have direct access to sys_audit, sys_journal_field, metric instance or time-worked tables as those are only available for admins and not everyone will get access to audit tables.

What I’d like to understand

• How are other organisations capturing this activity reliably?
• Is there an out-of-the-box report, supported API or alternative data source that captures all contributors?
• Could AI help parse activity already available through authorised access?
• If additional access or administrator configuration is unavoidable, what is the minimum supported solution?
• How do you distinguish substantive ticket activity from minor or automated updates, rather than simply counting every change?

I’ve considered periodically capturing the latest updater, but this could miss activity between checks. I am interested in a reliable, supported approach rather than a workaround that bypasses permissions.

Any practical examples or implementation recommendations would be appreciated.