Turns out theres "created" action, only "updated".
now checks the ticket was "updated", timerecid=0 and srtservicerecid=0 which SHOULD mean its the ticket being created