[Rtir] suggestion

[John Green]

Vytautas Krakauskas wrote:
> Hello,
> 
> I was wondering wouldn't it be nice to be able to "resolve" incident
> report, without creating an incident. Possible reason for this is that
> you forward a report to someone else, who is outside the RTIR, to
> resolve
> it and then forget about it. I am familiar with two ways to do this now:
> a) to reject it
> b) to move from RTIR to RT, and resolve it there.
> 
> Any other suggestions or comments?

Hi Vytautas,

We thought about the same problem when we helped design the current 
RTIR.  RT doesn't (AFAIK) have a easy way to bounce emails (certainly 
not unaltered, as they would have already been parsed by RT).

Either way, in our team we would want to keep a record that we passed it 
onto someone else to deal with ( in case 3 months later the person 
complains they did not receive resolution, we could look back and 
confirm that we sent on to XYZ to deal with at a specific time.  So in 
the case of a report coming to us, which should, for example, be dealt 
with by our naming admin people.

The IR would enter RTIR, we would make an Incident up to hold the 
Incident Report.  We would reply to the complainant (probably saying 
"You have contacted the wrong people, please email dns at xyz.net").
Then close Incident and Incident Report.  Or we would take the issue on, 
and open an investigation to the third party and work the issue to 
closure within our system.

We decision we made was that *any* ticket which we replied to, should be 
part of an incident.  The only IR's which don't become children of 
Incidents are rejected ones (which are primarily spam).

Hope this helps
John
JANET-CERT