[Rtir] How to disable automated forward to all correspondents?

[Kevin Falcone]

On Tue, Aug 07, 2012 at 05:00:09PM +0200, CERT-EU Collector wrote:
> Hello, Thanks for the reply. Indeed, by disabling the script, RTIR stop
> the auto-fowarding but we do not see anymore the list of correspondants
> when replying to an investigation (and report I also guess). Is there
> anyway, to stop the autoreply and still keep the list of correspondants?

Unfortunately, the Scrip you were instructed to delete is the Scrip
that notifies Requestors and Ccs, so RTIR no longer wants to send them
mail when you correspond.

I suspect you actually want to alter that Scrip to use a condition of
'RTIR Staff Response' which should stop the distribution when a
requestor emails in, but still allow a staff member to send mail out.

-kevin

> On 20/07/12 13:01, Jesper Skou Jensen wrote:
> > On 20-07-2012 11:41, collector wrote:> Hi,
> > >
> > > We have an issue. We sometimes issue general alert to multiple
> > > recipients. Then, we need sometimes to follow-up the incidents with
> > some
> > > of them. The default behavior of RTIR is that it will forward the
> > > response from one of the recipients of the original alert to all
> > others.
> > > How do we disable this? (RTIR 4.0.5).
> >
> > I would have a look in:
> > Menu
> > Tools
> > Configuration
> > Queues
> > Investigations(guessing you are using the default name?)
> > Scrips
> >
> > Maybe alter or delete "On Correspond Notify Requestors and Ccs"