Incidents can be created in Splunk On Call at the same time as a ticket is raised in Halo. This can be achieved for manual tickets, or for tickets raised via email that match an email rule. 

When raising a ticket, you can now choose a user or team/escalation policy to assign the incident to in Splunk On Call. A default value for this option can be configured at ticket type level.

When responding to or resolving a ticket that is linked to a Splunk On Call incident, the incident will be automatically acknowledged/resolved in Splunk On Call. Notes can also be pushed from a Halo ticket to a Splunk On Call incident.