Thanks for the great information! I'lll give it a shot.
We also want to limit by request category, but that part was working correctly in the site-defined condition so I didn't mention it. Could category be added to the filter? Is this syntax for this documented anywhere? What is the 14438?
I could probably steer them towards opening a child ticket via IT PAM automation, but that has the same issue of getting the Event to trigger.
In the larger context this is for tickets opened via customer email, being worked and closed, but then the customer providing an update via email that logs a new comment to the closed ticket.