Reporter field changes
KPIHow often the reporter field on tickets gets changed after the fact. Most legitimate cases involve handoffs (an assistant filing on behalf, an automation correcting itself); persistent activity by one actor is worth a closer look.