I see a bigger issue here, and IMO one of Orion's biggest failings. Whilst creating a ticket in an external system is one thing, showing that an outage or incident is being handled in Orion seems very difficult, and makes the tool much less useful than it could be. Ideally the process should be:
1. Orion detects a state change to an error condition
2. Orion creates an alert and that interfaces to an external ticketing system
3. The ticketing systems sends an arbitrary reply (e,g. the ticket number)
4. Orion marks the event as acknowledged, and includes the reply from the external system in all displays
At this point we can see in Orion that a system has failed, but is being handled.
Nirvana would be when Orion detects the failed system as operational again, and can send an UP notification to the ticking system along with the returned reference. This would allow for automated incident closure in the remote ticketing system.
BTW notifications via email might be convenient, but it's not a good idea. Firstly the protocol (SMTP) does not guarantee delivery, and secondly what if the failed system is the email system? A SOAP (urghh) or some other API would be a far better idea.
Dave