Suggestion

RTIR
1

Hello,

I was wondering wouldn’t it be nice to be able to “resolve” incident
report, without creating an incident. Possible reason for this is that
you forward a report to someone else, who is outside the RTIR, to resolve
it and then forget about it. I am familiar with two ways to do this now:
a) to reject it
b) to move from RTIR to RT, and resolve it there.

Any other suggestions or comments?

Vytautas Krakauskas
LitNET NOC CERT
phone: +370 37 300645
Email: cert@litnet.lt

2

Vytautas Krakauskas wrote:

Hello,

I was wondering wouldn’t it be nice to be able to “resolve” incident
report, without creating an incident. Possible reason for this is that
you forward a report to someone else, who is outside the RTIR, to
resolve
it and then forget about it. I am familiar with two ways to do this now:
a) to reject it
b) to move from RTIR to RT, and resolve it there.

Any other suggestions or comments?

Hi Vytautas,

We thought about the same problem when we helped design the current
RTIR. RT doesn’t (AFAIK) have a easy way to bounce emails (certainly
not unaltered, as they would have already been parsed by RT).

Either way, in our team we would want to keep a record that we passed it
onto someone else to deal with ( in case 3 months later the person
complains they did not receive resolution, we could look back and
confirm that we sent on to XYZ to deal with at a specific time. So in
the case of a report coming to us, which should, for example, be dealt
with by our naming admin people.

The IR would enter RTIR, we would make an Incident up to hold the
Incident Report. We would reply to the complainant (probably saying
“You have contacted the wrong people, please email dns@xyz.net”).
Then close Incident and Incident Report. Or we would take the issue on,
and open an investigation to the third party and work the issue to
closure within our system.

We decision we made was that any ticket which we replied to, should be
part of an incident. The only IR’s which don’t become children of
Incidents are rejected ones (which are primarily spam).

Hope this helps
John
JANET-CERT

3

Is it possible to add the option of comments section when you take
charge of something?

That way, I can take charge and say that I all ready have someone on it,
so that everyone only sees one mail not two…and it’s only one step
not two.

does that make sense?
Just trying to make the flow a little easier…

thanks.

-dc
Danielle Cambridge
Lead TA | Blue Sky Studios
danielle@blueskystudios.com