OCCURRENCE: Anytime
OBSERVATION: Check to see if the ticket looks like the above. If there are any major differences, escalate to tier 3. The key thing you are looking for is the last line under POST VALS where it gives the passed URL.
ACTION: If that URL looks strange, escalate to Tier 2. If it is a reference to an external site (e.g. Google.com, Apple.Com, etc.). Add the tag "Monitor" (or use the "monitor" scenario) and mark it as closed.
SOURCE: MYLC