CF default value set via email input

RTIR
1

Greetings,

Trying to find a solution to this:

We have a CF called ‘How Reported’ that allows us to track which of
our IR inputs we received IR on (email, phone, SIEM, etc.). All
“manual” input sources explicitly set the value of this field to
appropriate values. The one remaining input is via email using
rt-mailgate; we’d like this to be set as well.

We first thought to populate %RTIR_CustomFieldsDefaults with the
default value the field should have so that if not populated (as it
would be via email receipt) it would inherit the default.

Set(
%RTIR_CustomFieldsDefaults,

'How Reported'       => 'CIRT Email',

);

We’re finding that this seemingly isn’t applied when the email arrives
via rt-mailgate and therefore the REST API. It is reflected when
viewing a new IR that is created via the standard web user UI, but not
applied when the IR arrives via email.

What sensible approaches are there for applying this default when new
IRs arrive via the email interface? I’m supposing a scrip/action might
be one option.

RT 3.8.8
RTIR 2.6.0
Perl 5.8.8
DBIx::SearchBuilder 1.54
Linux 2.6.18-238.19.1.0.1.el5 #1 SMP Fri Jul 15 04:42:13 EDT 2011
x86_64 x86_64 x86_64 GNU/Linux

Thanks,

Darren Spruell
phatbuckett@gmail.com

2

We first thought to populate %RTIR_CustomFieldsDefaults with the
default value the field should have so that if not populated (as it
would be via email receipt) it would inherit the default.

Set(
%RTIR_CustomFieldsDefaults,

'How Reported'       => 'CIRT Email',

);

As you’ve discovered, those are mostly used just to set the default in
the Web UI when you click New Ticket In or one of the other create
items.

We’re finding that this seemingly isn’t applied when the email arrives
via rt-mailgate and therefore the REST API. It is reflected when
viewing a new IR that is created via the standard web user UI, but not
applied when the IR arrives via email.

What sensible approaches are there for applying this default when new
IRs arrive via the email interface? I’m supposing a scrip/action might
be one option.

I’d do an On Create scrip with a User Defined action that checks
FirstCustomFieldValue to see if How Reported is set and sets it if it
doesn’t already have a value.

-kevin