Request Tracker for Incident Response (RTIR) Kevin Falcone Best Practical Solutions
RT/RTIR RT RTIR Extending RTIR Future development of RTIR
REQUEST TRACKER RT is a ticketing system Bugtracking Helpdesk Invoicing Incidents Sales Network Operations Abuse
REQUEST TRACKER It doesn't care what you're tracking A few key concepts that RTIR builds on
REQUEST TRACKER Queues Basic organizational unit for RT A ticket is in exactly one Queue Most common abstraction for access control
REQUEST TRACKER Custom Fields Custom data storage on Tickets or other RT objects Many render/storage formats New in RT 4 Date and Datetime IPv4 and IPv6 based on previous work for RTIR
REQUEST TRACKER Users Privileged Staff users (passwords, full access) Unprivileged May have SelfService view May just exist because of email
REQUEST TRACKER History Transactions Immutable history of changes to a ticket Attachments Email contents Email attachments Uploaded files
REQUEST TRACKER Workflows Scrips Conditions Actions Templates RTIR contains 30+ Scrips
REQUEST TRACKER Releases 4.0.5 Major series Minor series Release Smaller, more stable releases bugfixes only easier to stay up to date
REQUEST TRACKER Open Source https://github.com/bestpractical/rt 3.8-trunk 4.0-trunk master
RTIR RT Extension Four Special Queues IRT specific workflow Extraction and Searching of information Collecting related tickets
INCIDENT REPORTS Incident Reports Queue Manual Reports External Automated Systems Default CFs How Reported Reporter Type Customer
INCIDENTS Incidents Queue Collects 1, 100, more IRs into a single Incident Central point of ownership Central place to communicate Central collection of data
INCIDENTS Default CFs Description Function Classification Resolution
INVESTIGATIONS Investigations Queue External Communications Gathering further information Separate from IRs which would go back to the reporter of the problem. Default CFs Investigation
BLOCKS Blocks Queue Communication to network team Can be disabled if unused Default CFs Netmask Port Where Blocked
RTIR CUSTOM FIELDS Constituency Separate responsibility for handling IPs Automatic extraction of IP addresses from all ticket data Linking and Searching between
LOOKUPS Internal searching whois traceroute ping external webservices internal webservices
LOOKUP Set( @RTIRResearchTools, (qw(traceroute Whois Iframe))); Set($RTIRIframeResearchToolConfig, { 1 => { FriendlyName => 'Google', URL => 'https://encrypted.google.com/search? q= SearchTerm ' },... Set($whois, { 1 => { Host => "whois.iana.org", FriendlyName => "IANA", },...
LOOKUP Add your own iframe link Create a local/rtir/tool/elements/ ToolFormSite local/rtir/tool/elements/ ToolResultsSite Add to RTIRResearchTools Hide things you don't use (traceroute?)
RTIR CUSTOMIZATIONS External Custom Fields RT-Extension-ACNS Custom Lookup from earlier
EXTERNAL CUSTOM FIELDS Source the values of a drop down from external web service external db information pulled from RT Documentation and sample included with RT since 3.8.0
RT-EXTENSION-ACNS Parses pre 1.0 ACNS emails Maps contents into custom fields Available on CPAN and GitHub
RTIR'S DEVELOPMENT Janet-CSIRT v1 TC-CSIRT RTIR-WG v2 2.4 and 2.6 2.6 removed many restrictions on the Custom Fields used in RTIR
RTIR'S DEVELOPMENT 3.0 (compat with RT 4.0) Removed State => Lifecycles Removed custom SLA RT::Extension::SLA is much richer All other 4.0 improvements Bring searching closer to core Replace/Rework Net::Whois::RIPE
RTIR DEVELOPMENT 4.0 Improvements User interface overhaul Ticket lifecycles Mobile web interface Online theme editor GMail style history folding RTFM integrated as Articles
RTIR DEVELOPMENT Full-text search AJAX completion of email addresses Better HTML mail support New rights management UI Hundreds of performance improvements and bugfixes More tests
RTIR DEVELOPMENT RTIR 3.0 rtir-devel@lists.bestpractical.com http://issues.bestpractical.com/ log in as guest ticket #18710 https://github.com/bestpractical/rtir I'm a software vendor, don't trust my ship dates.
RTIR DEVELOPMENT RTIR 3.2 will block the release of RT 4.2 Custom Field groups in 4.2 Removes more RTIR complexity S/MIME support on par with GPG Improved Scrips UI Improved General Statistics RTIR Search Refactoring Assets extension Possible Constituencies Enhancements
RTIR SUPPORT rtir-devel@lists.bestpractical.com rt-users@lists.bestpractical.com #rt irc.perl.org Professional support and customization
RTIR WORKING GROUP MEETING Wednesday afternoon Seats may still be available? Driving the future features of RTIR What workflows don't we know about
Questions