The MSP I work for has a system that monitors for passwords, but also any PII. Which (as you know) includes social security numbers, credit card numbers, addresses, etc. It also goes by email domain (ie, @foo.com), so we don't have to manually put in users.

It is, to be completely honest, a huge piece of crap.

A third to half of the tickets it creates are for users that don't exist or users that have been off boarded. This can be fixed by connecting O365 to the system. I don't have permission, and the people who do say they'll get to it, then I never hear back.

Another third to half of the tickets are phone numbers, addresses, and names. As in, john.smith@foo.com, their real name is John Smith. There is nothing anyone can do about this. The vendor cannot get rid of these, we cannot get rid of them, and there's no api, so I couldn't even remove them programmatically.

The rest are almost always false positives and/or duplicates.

With that context given, three weeks ago it created 1,900 tickets. We support 1,500 endpoints. Over the two weeks it took me to close all of that it created atleast another 500.

So yes, I spent a week going through a loop of:

if user.identity == nonExistent:
    merge(user)
elif user.data == notActionable:
    merge(user)
elif user.data == duplicate:
    merge(user)
else:
    user.call()

Honestly, if I didn't have the ability to watch shojo romance anime on my phone while working, I think I would have had a complete meltdown.

You may be wondering why no one else helped. That's simple: I'm the only one who ignores ticket queues, so I'm the only one who sees that we have a separate ticket queue for these, and therefore knows that they exist.

Also, we bill a minimum of 15min/ticket, so even with all of the merging, I ended up with more than 200 billed hours that week.