Request Tracker for Incident Response
Request Tracker for Incident Response (RTIR) adds incident-response queues and workflows to RT for teams such as CERTs and CSIRTs.
What Request Tracker for Incident Response is
Request Tracker for Incident Response (RTIR) adds incident-response queues and workflows to RT for teams such as CERTs and CSIRTs. It can correlate information from reports, identify patterns, and connect related reports to a common root-cause incident. Separate queues support report triage, incident handling, investigation, and countermeasures, with communication tools for reporters, other security teams, and internal responders. Tickets record activity, allow custom fields, and track key dates for service-level agreements. Teams can generate activity reports in HTML, text, or spreadsheet formats. The RT API can receive automated feeds from systems including Splunk, ArcSight, Nagios, Squil, and Qualys. RTIR also parses IP addresses into custom fields and provides lookup interfaces such as traceroute and whois. Incidents can be merged or split, and status changes can cascade across linked tickets. The software is available for free download and self-hosting; Cloud RT is also offered. The Community plan costs nothing. Paid support is available, and the vendor offers a 14-day trial for on-premise or Cloud RT deployment.
Good
- Correlates reports and links related incidents
- Separate queues support key response workflows
- Activity reports support HTML, text, and spreadsheet formats
- Available to download and self-host
Watch out
- Build and Scale support plans are billed annually
- Trial lasts 14 days
Who it suits
RTIR suits incident-response teams that need structured queues, linked-report handling, and communication across internal and external responders. It also fits organizations that want to download and self-host RTIR or select Cloud RT.
Verdict
RTIR provides incident-focused workflows, reporting, and ticket operations for security response teams. Teams can self-host it or choose Cloud RT, with a 14-day trial available for either deployment selection.
Plans and prices
From Request Tracker for Incident Response's own pricing page, checked 8 Oct 2001.
| Plan | Price | What it gives you |
|---|---|---|
| Community | Free | Unlimited users & tickets · full RT feature set · source code & API access · community forum support |
| Build | $450 a month | 20,000 tickets/year · 1 designated support rep · email support · 2 business day SLA · 1 support request / quarter · 4 Q&A requests / quarter · Billed annually |
| Scale | $1,650 a month | 100,000 tickets/year · 2 designated support reps · email & chat support · 1 business day SLA · 4 support requests / quarter · 8 Q&A requests / quarter · Billed annually |
| Transform | Priced on request | Unlimited tickets · 4 designated support reps · email & chat support · 4 business hour SLA · 24×7 emergency support |
The facts
Each one read from Request Tracker for Incident Response's own pages, with the date it was checked.
What it does
- Automation
- The RT API can accept automatic data feeds from systems including Splunk, ArcSight, Nagios, Squil, and Qualys.checked 8 Oct 2001
- Communications
- Teams can communicate with reporters, counterparts at other security teams, and internal teams coordinating countermeasures.checked 8 Oct 2001
- Data and audit
- Tickets log activity, support custom fields, and track key dates for SLAs.checked 8 Oct 2001
- Deployment
- RT and RTIR are available for free download and self-hosting, and the vendor also offers Cloud RT.checked 8 Oct 2001
- Incident correlation
- RTIR correlates information from incident reports to find patterns and link reports to a common root cause incident.checked 8 Oct 2001
- Incident handling
- RTIR supports merging and splitting incidents, bulk ticket operations, and cascading status changes across linked tickets.checked 8 Oct 2001
- Network analysis
- RTIR parses IP addresses into custom fields and provides lookup interfaces including traceroute, whois, and remote site security ratings.checked 8 Oct 2001
- Purpose
- RTIR builds on RT with preconfigured queues and workflows designed for incident response teams and is used by CERT and CSIRT teams.checked 8 Oct 2001
- Reporting
- RTIR can generate activity reports in HTML, text, or spreadsheet format and report activity by dates and constituencies.checked 8 Oct 2001
- Security
- The vendor accepts software security reports by email and provides a public key for encrypting reports.checked 8 Oct 2001
- Support
- Paid on-premise support plans include installation and upgrade support, product bug triage, direct access to RT engineers, and formal SLA response times.checked 8 Oct 2001
- Workflows
- Separate queues support report triage, incident handling, investigation, and countermeasures.checked 8 Oct 2001
The company
- Headquarters
- Waltham, Massachusetts, United Stateschecked 28 Sep 2001
- Maker
- Best Practical Solutions LLC develops and maintains RT and RTIR and says it has served organizations worldwide since 2001.checked 8 Oct 2001
Money
- Trial
- The vendor offers a 14-day trial for RT or RTIR with either on-premise or Cloud RT deployment selection.checked 8 Oct 2001
Alternatives to Request Tracker for Incident Response
- 1
PagerDuty
Free planAndroidiOSWebAPI8.2From $21 a month - 2
xMatters
Free planAndroidiOSWebAPI8.2From $15 a month - 3
AlertOps
Free planAndroidiOSWebAPI8.1From $8 a month - 4
DFIR-IRIS
Free planOpen sourceWebAPILinuxmacOS7.7Free plan - 5
DFIRe
Free planWebAPILinuxSelf-hosted7.6Free plan - 6
incident.io
Free planAndroidiOSWebAPI7.5From $15 a month