Stop 9 of 9 · Weekly
Tariq's week
The morning digest, the Friday pattern report and the monthly patch summary on a timer, the knowledge-base backlog handed to Cowork, and one ticket taken end to end.
The shape of the week
Everything in stops 1 to 8 is a thing Tariq does when a ticket lands. This stop is the part that runs whether or not anything lands, because the desk only gets quieter if the repeat causes get fixed permanently, and that only happens if someone looks.
Three jobs are the same every time, which is exactly what makes them worth putting on a timer.
Morning digest, weekdays at 07:30. Overnight mail from the shared mailbox and the Atera alerts, triaged and sorted, waiting when Tariq opens the laptop.
Friday pattern report, 15:00. From the exported ticket CSV: repeat causes ranked by the hours they cost, not by count.
Monthly patch summary, first Monday. Which advisories touch the kit that is actually deployed, and what waits until the window.
Here are the overnight messages from the IT shared mailbox and the alerts from Atera. Redact nothing back to me, I have already removed credentials. Give me one table: title under ten words, severity P1 to P4, category, and the first action. Sort P1 and P2 to the top. Below the table, list any messages that look like one shared cause, and name the cause. Then list anything that has been waiting more than two working days.
Attached is the export of tickets closed this week: category, title, opened, closed, handling time, device, user. Give me four things. One, the repeat causes ranked by total handling time, with the ticket count beside each. Two, for the top three, whether they cluster on a device model, a site, a user group or a time of day. Three, for each of those, one permanent fix and roughly what it would cost me to make it. Four, anything that appeared this week and has never appeared before. Do not rank by ticket count. Rank by time.
Research the advisories published in the last month for these products, and use the vendor advisories and official CVE entries as sources, with citations. Products and versions in use: [paste your firmware and OS build list] For each advisory that touches a version we actually run: severity, whether it is exploited in the wild, the fixed version, and whether it can wait for the next maintenance window. Ignore anything that does not touch a version on that list, and say how many you ignored.
The backlog and the tools
Cowork is where the knowledge-base backlog goes. It is bulk work with a known shape: take the change notes from this month, draft an article for each, propose the searchable title. Tariq reads and corrects rather than types, and start it in the approval mode that shows you each step before it acts.
Claude Code is for the internal tools he keeps meaning to build: the script that reconciles the Atera device list against Intune enrolment, the small page that shows which laptops have missed two patch cycles. Same rule as stop 4, read every line before it runs, and point it at an export rather than a live tenant on the first attempt.