Request Tracker for Incident Response (RTIR)

Transcription

1 Request Tracker for Incident Response (RTIR) Kevin Falcone Best Practical Solutions

2 RT/RTIR RT RTIR Extending RTIR Future development of RTIR

3 REQUEST TRACKER RT is a ticketing system Bugtracking Helpdesk Invoicing Incidents Sales Network Operations Abuse

4 REQUEST TRACKER It doesn't care what you're tracking A few key concepts that RTIR builds on

5 REQUEST TRACKER Queues Basic organizational unit for RT A ticket is in exactly one Queue Most common abstraction for access control

6 REQUEST TRACKER Custom Fields Custom data storage on Tickets or other RT objects Many render/storage formats New in RT 4 Date and Datetime IPv4 and IPv6 based on previous work for RTIR

7 REQUEST TRACKER Users Privileged Staff users (passwords, full access) Unprivileged May have SelfService view May just exist because of

8 REQUEST TRACKER History Transactions Immutable history of changes to a ticket Attachments contents attachments Uploaded files

9 REQUEST TRACKER Workflows Scrips Conditions Actions Templates RTIR contains 30+ Scrips

10 REQUEST TRACKER Releases Major series Minor series Release Smaller, more stable releases bugfixes only easier to stay up to date

11 REQUEST TRACKER Open Source trunk 4.0-trunk master

12 RTIR RT Extension Four Special Queues IRT specific workflow Extraction and Searching of information Collecting related tickets

13 INCIDENT REPORTS Incident Reports Queue Manual Reports External Automated Systems Default CFs How Reported Reporter Type Customer

14

15

16

17 INCIDENTS Incidents Queue Collects 1, 100, more IRs into a single Incident Central point of ownership Central place to communicate Central collection of data

18 INCIDENTS Default CFs Description Function Classification Resolution

19

20

21

22 INVESTIGATIONS Investigations Queue External Communications Gathering further information Separate from IRs which would go back to the reporter of the problem. Default CFs Investigation

23

24

25

26

27

28 BLOCKS Blocks Queue Communication to network team Can be disabled if unused Default CFs Netmask Port Where Blocked

29

30 RTIR CUSTOM FIELDS Constituency Separate responsibility for handling IPs Automatic extraction of IP addresses from all ticket data Linking and Searching between

31

32

33

34

35 LOOKUPS Internal searching whois traceroute ping external webservices internal webservices

36

37 LOOKUP (qw(traceroute Whois Iframe))); Set($RTIRIframeResearchToolConfig, { 1 => { FriendlyName => 'Google', URL => ' q= SearchTerm ' },... Set($whois, { 1 => { Host => "whois.iana.org", FriendlyName => "IANA", },...

38 LOOKUP Add your own iframe link Create a local/rtir/tool/elements/ ToolFormSite local/rtir/tool/elements/ ToolResultsSite Add to RTIRResearchTools Hide things you don't use (traceroute?)

39 RTIR CUSTOMIZATIONS External Custom Fields RT-Extension-ACNS Custom Lookup from earlier

40 EXTERNAL CUSTOM FIELDS Source the values of a drop down from external web service external db information pulled from RT Documentation and sample included with RT since 3.8.0

41 RT-EXTENSION-ACNS Parses pre 1.0 ACNS s Maps contents into custom fields Available on CPAN and GitHub

42 RTIR'S DEVELOPMENT Janet-CSIRT v1 TC-CSIRT RTIR-WG v2 2.4 and removed many restrictions on the Custom Fields used in RTIR

43 RTIR'S DEVELOPMENT 3.0 (compat with RT 4.0) Removed State => Lifecycles Removed custom SLA RT::Extension::SLA is much richer All other 4.0 improvements Bring searching closer to core Replace/Rework Net::Whois::RIPE

44 RTIR DEVELOPMENT 4.0 Improvements User interface overhaul Ticket lifecycles Mobile web interface Online theme editor GMail style history folding RTFM integrated as Articles

45 RTIR DEVELOPMENT Full-text search AJAX completion of addresses Better HTML mail support New rights management UI Hundreds of performance improvements and bugfixes More tests

46 RTIR DEVELOPMENT RTIR log in as guest ticket # I'm a software vendor, don't trust my ship dates.

47 RTIR DEVELOPMENT RTIR 3.2 will block the release of RT 4.2 Custom Field groups in 4.2 Removes more RTIR complexity S/MIME support on par with GPG Improved Scrips UI Improved General Statistics RTIR Search Refactoring Assets extension Possible Constituencies Enhancements

48 RTIR SUPPORT #rt irc.perl.org Professional support and customization

49 RTIR WORKING GROUP MEETING Wednesday afternoon Seats may still be available? Driving the future features of RTIR What workflows don't we know about

50 Questions