Re: RT-IR experiences

[Chris Russel <russel () YORKU CA>]

We're using both RT and RT-IR, for about 4 years, and find them
indispensable. Integration with our home-brew automated incident response
(CECR) works great and was done with fairly straight-forward scripting.

There's certainly room for improvement, better reporting comes to mind,
but it does the job and is fairly easy to integrate with other systems
compared with commercial alternatives I've seen (admittedly limited
experience there).

--
Chris Russel
Director, I.T. Infrastructure
Information Security Officer
Computing and Network Services
York University, Toronto, Canada


On Mon, 21 Jul 2008, Melissa Muth wrote:

> We're considering deploying RT-IR for tracking incidents. If you are using
> it, we'd appreciate hearing about your experiences.
>
> Based on a survey conducted by H. Morrow Long about 2 years ago, 28% of
> respondents were using RT, and 10% were using RT-IR. Since RT-IR was enhanced
> significantly around that time, I wonder if anyone has migrated to it in the
> past two years.
>
> Thanks in advance!
>
> Melissa
> --
> Melissa Muth
> Sr. Information Security Analyst
> Information Systems & Computing
> University of Pennsylvania
> muthm () isc upenn edu   215-573-6798