I created this Incident Rule to accommodate incident resolution by e-mail for my techs. We have a Validation Rule in place that requires a close code to resolve or close an incident, so that is where the extra variables come into play. You should be able to adapt this to what you need.

Name: Resolve Incident from Email - Success 
Comment: Allows a worker to change incident Status to "Resolved" with Close Code "Completed Successfully" by using a keyword in the body of an e-mail.
Set these properties: Set "Close code" to "Completed Successfully"
Set "Status" to "Resolved"
When: Every time incident is saved
And: When ALL of these are TRUE
"Comment" contains "resolve_success"
<end>
Status: Active
Is terminal: No

Have Fun!

We created a rule that when an incident was updated by anyone other then the assigned user it changed the Urgency to High and kicked off an Incident update e-mail.  This would notify the assigned worker that their incident has been updated and gives them a quick link to open the incident.  I then added a task to the console that would allow then to change the urgency from High to Low without actually opening the incident.  We used the Urgency field because its not currently being used in out implementation.  Just make sure you add in a exclusion if the incident is assigned to a queue, other wise you will be spamming all the workers assigned to that queue.
Hope this helps

Incident Rule

When ALL of these are TRUE
"Modified on" changes
"Modified by worker" is not equal to "Assigned worker"
"Assigned to a queue" is equal to "false"
"Category" does not contain "Service Request\CS\Altiris Solutions"
"Category" does not contain "Change-Move\AppDev"
When ANY of these is FALSE
"Assigned worker" changes
<end>
<end>

Notify Rule

When ALL of these are TRUE
"Category" does not contain "Change-Move\AppDev"
"Assigned worker" is not one of "[unassigned], Altiris Administrators , Applications Triage, Article Review, Asset Management, Business Warehouse, Change Advisory Board, Client Support, Deployment-SW Delivery, Engineering, Human Resources, LPD, IT Security, MCPC Service, Network Support, Operations, Professional Services, SAP Security , SAP Technical/Basis, Server Support, Supervisor, Telecommunications, Tier 1"
"Modified on" changes
<end>

Task properties:

Name: Change Urgency from High to Low

Comment: Change the Urgency of an incident from High to Low after an incident has been updated and read by the assigned worker.

Service Category: Helpdesk

Include in Common Service Category: No

Rank: 1

Display: Incident view page

Logging: Logging to incident will not occur

Status: Active

Visible to guests: No

Task is available: When ALL of these are TRUE
"Urgency" is equal to "High"
"Status" is one of "Planned, Requested, Open, Resolved, Hold, Quoted, Approved, Ordered"
<end>

URL: http://SERVERNAME/AeXHD/Default.aspx

URL processing: Allow Helpdesk to process

URL parameters: id WORKITEM(workitem_number)
workitem_urgency_lookup_id 300
commit yes
cmd editItem

Send parameters using: POST

Credentials: Impersonate the worker

User interface: Commit the incident and display the View Incident page

Open in new window: No

this are good information thanks guys.