[Rtir] Formatted output from RTIR

Kevin Falcone falcone at bestpractical.com
Tue Mar 13 14:49:27 EDT 2012

Please keep list replies on the list.

On Tue, Mar 13, 2012 at 09:19:03AM +0000, Matt Newham wrote:
>    Thanks for the pointers. Basically, the way I am currently trialling RT is within a SOC like
>    environment over a CERT. I have used it in previous positions in both capacities. Here is an
>    example of workflow:
>    Incident -> Create Incident Ticket -> Gather evidence etc & complete mandatory fields ->
>    Create linked Incident Report -> Incident report pulls selected information from the Incident
>    -> Management "approve" the report -> Report gets moved to "reporting" queue for the
>    respective client -> client can view that queue and take ownership of the ticket for remedial
>    action
>    So, what I would like is the "Incident Report" details to be pulled out and dropped into a
>    templated output (currently this is a word template which is manually completed by the
>    analysts, I dont want to duplicate effort so if the report can be automagically populated that
>    would be preferable). This can then be issued to the less technical folk in the client org or
>    for any clients that don't have the capability to access RT.
>    What do you think to the above? I think most of the workflow parts I can do with the approval
>    plugin, scrips to move tickets around etc

It sounds like you need to learn RT's perl api and export data using
it.  I'm not sure how best to trick word into believe that it's a doc,
you may want to just generate HTML and work from there.


More information about the Rtir mailing list