BESTPRACTICALTM

Request Tracker for Incident Response

(RTIR)

Kevin FalconeBest Practical Solutions

BESTPRACTICALTM

RT/RTIR

• RT• RTIR• Extending RTIR• Future development of RTIR

BESTPRACTICALTM

REQUEST TRACKER

• RT is a ticketing system• Bugtracking• Helpdesk• Invoicing• Incidents• Sales• Network Operations• Abuse

BESTPRACTICALTM

REQUEST TRACKER

• It doesn't care what you're tracking• A few key concepts that RTIR builds on

BESTPRACTICALTM

REQUEST TRACKER

• Queues• Basic organizational unit for RT• A ticket is in exactly one Queue• Most common abstraction for access

control

BESTPRACTICALTM

REQUEST TRACKER

• Custom Fields• Custom data storage on Tickets or

other RT objects• Many render/storage formats• New in RT 4

• Date and Datetime• IPv4 and IPv6

• based on previous work for RTIR

BESTPRACTICALTM

REQUEST TRACKER

• Users• Privileged

• Staff users (passwords, full access)• Unprivileged

• May have SelfService view• May just exist because of email

BESTPRACTICALTM

REQUEST TRACKER

• History• Transactions

• Immutable history of changes to a ticket• Attachments

• Email contents• Email attachments• Uploaded files

BESTPRACTICALTM

REQUEST TRACKER

• Workflows• Scrips

• Conditions• Actions• Templates• RTIR contains 30+ Scrips

BESTPRACTICALTM

REQUEST TRACKER

• Releases• 4.0.5

• Major series• Minor series• Release

• Smaller, more stable releases• bugfixes only• easier to stay up to date

BESTPRACTICALTM

REQUEST TRACKER

• Open Source• https://github.com/bestpractical/rt

• 3.8-trunk• 4.0-trunk• master

BESTPRACTICALTM

RTIR

• RT Extension• Four Special Queues• IRT specific workflow• Extraction and Searching of information• Collecting related tickets

BESTPRACTICALTM

INCIDENT REPORTS

• Incident Reports Queue• Manual Reports• External Automated Systems

• Default CFs• How Reported• Reporter Type• Customer

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

INCIDENTS

• Incidents Queue• Collects 1, 100, more IRs into a single

Incident• Central point of ownership• Central place to communicate• Central collection of data

BESTPRACTICALTM

INCIDENTS

• Default CFs• Description• Function• Classification• Resolution

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

INVESTIGATIONS

• Investigations Queue• External Communications• Gathering further information• Separate from IRs which would go back

to the reporter of the problem.• Default CFs

• Investigation

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

BLOCKS

• Blocks Queue• Communication to network team• Can be disabled if unused

• Default CFs• Netmask• Port• Where Blocked

BESTPRACTICALTM

BESTPRACTICALTM

RTIR CUSTOM FIELDS

• Constituency• Separate responsibility for handling

• IPs• Automatic extraction of IP addresses

from all ticket data• Linking and Searching between

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

BESTPRACTICALTM

LOOKUPS

• Internal searching• whois• traceroute• ping• external webservices• internal webservices

BESTPRACTICALTM

BESTPRACTICALTM

LOOKUP

Set( @RTIRResearchTools,

(qw(Traceroute Whois Iframe)));

Set($RTIRIframeResearchToolConfig, {

1 => { FriendlyName => 'Google', URL => 'https://encrypted.google.com/search?q=__SearchTerm__' }, ...

Set($whois, { 1 => {

Host => "whois.iana.org",

FriendlyName => "IANA",

}, ...

BESTPRACTICALTM

LOOKUP

• Add your own iframe link• Create a

• local/RTIR/Tool/Elements/ToolFormSite

• local/RTIR/Tool/Elements/ToolResultsSite

• Add to RTIRResearchTools• Hide things you don't use (traceroute?)

BESTPRACTICALTM

RTIR CUSTOMIZATIONS

• External Custom Fields• RT-Extension-ACNS• Custom Lookup from earlier

BESTPRACTICALTM

EXTERNAL CUSTOM FIELDS

• Source the values of a drop down from• external web service• external db• information pulled from RT

• Documentation and sample included with RT since 3.8.0

BESTPRACTICALTM

RT-EXTENSION-ACNS

• Parses pre 1.0 ACNS emails• Maps contents into custom fields• Available on CPAN and GitHub

BESTPRACTICALTM

RTIR'S DEVELOPMENT

• Janet-CSIRT v1• TC-CSIRT RTIR-WG v2

• 2.4 and 2.6• 2.6 removed many restrictions on the

Custom Fields used in RTIR

BESTPRACTICALTM

RTIR'S DEVELOPMENT

• 3.0 (compat with RT 4.0)• Removed State => Lifecycles• Removed custom SLA

• RT::Extension::SLA is much richer• All other 4.0 improvements• Bring searching closer to core• Replace/Rework Net::Whois::RIPE

BESTPRACTICALTM

RTIR DEVELOPMENT

• 4.0 Improvements• User interface overhaul• Ticket lifecycles• Mobile web interface• Online theme editor• GMail style history folding• RTFM integrated as “Articles”

BESTPRACTICALTM

RTIR DEVELOPMENT

• Full-text search• AJAX completion of email addresses• Better HTML mail support• New rights management UI• Hundreds of performance improvements

and bugfixes• More tests

BESTPRACTICALTM

RTIR DEVELOPMENT

• RTIR 3.0• rtir-devel@lists.bestpractical.com• http://issues.bestpractical.com/

• log in as guest• ticket #18710

• https://github.com/bestpractical/rtir• I'm a software vendor, don't trust my

ship dates.

BESTPRACTICALTM

RTIR DEVELOPMENT

• RTIR 3.2 will block the release of RT 4.2• Custom Field groups in 4.2

• Removes more RTIR complexity• S/MIME support on par with GPG• Improved Scrips UI• Improved General Statistics

• RTIR Search Refactoring• Assets extension• Possible Constituencies Enhancements

BESTPRACTICALTM

RTIR SUPPORT

• rtir-devel@lists.bestpractical.com• rt-users@lists.bestpractical.com• #rt irc.perl.org• Professional support and customization

BESTPRACTICALTM

RTIR WORKING GROUP MEETING

• Wednesday afternoon• Seats may still be available?

• Driving the future features of RTIR• What workflows don't we know about

BESTPRACTICALTM

Questions