category: Case Management
provider: Open Source
commonfields:
  id: RTIR
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Server URL (e.g. http://192.168.0.1)
  name: server
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: false
  type: 9
  section: Connect
- name: token
  type: 9
  displaypassword: Token
  hiddenusername: true
  section: Connect
- display: Certificate
  name: certificate
  type: 9
  required: false
  section: Connect
  displaypassword: Private Key
- display: 'Trust any certificate (not secure)'
  name: unsecure
  type: 8
  required: false
  section: Connect
- display: 'Use system proxy settings'
  name: proxy
  type: 8
  required: false
  section: Connect
- display: 'Fetch incidents'
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: 'Incident type'
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- defaultvalue: 'new,open'
  display: 'Fetch incidents of the following status:'
  name: fetch_status
  type: 0
  required: false
  section: Collect
- display: 'Fetch incidents with priority greater or equal to:'
  name: fetch_priority
  type: 0
  required: false
  defaultvalue: '0'
  section: Collect
- defaultvalue: 'Incident Reports'
  display: Queue name to fetch incidents from
  name: fetch_queue
  type: 0
  required: false
  section: Collect
- display: Referer request header
  name: referer
  type: 0
  required: false
  section: Collect
- defaultvalue: '0'
  display: Fetch incidents limit (the max amount of incidents per fetch iteration)
  name: fetch_limit
  type: 0
  required: false
  section: Collect
description: Request Tracker for Incident Response is a ticketing system which provides pre-configured queues and workflows designed for incident response teams.
display: RTIR
name: RTIR
script:
  commands:
  - arguments:
    - defaultValue: General
      description: Queue where to create the ticket.
      name: queue
    - description: Subject of the ticket.
      name: subject
      required: true
    - description: Requestor email address.
      name: requestor
    - description: Sends a carbon-copy of this update to a comma-delimited list of email addresses. These people will receive future updates.
      name: cc
    - description: Sends a carbon-copy of this update to a comma-delimited list of administrative email addresses. These people will receive future updates.
      name: admin-cc
    - description: Ticker owner.
      name: owner
    - description: Ticket status.
      name: status
    - description: Ticket priority, given as number in the range 0-100.
      name: priority
    - description: The ticket content.
      name: text
    - description: Ticket initial priority, given as number in the range 0-100.
      name: initial-priority
    - description: Ticket final priority, given as number in the range 0-100.
      name: final-priority
    - description: Ticket MemberOF ID.
      isArray: true
      name: member-of
    - description: Ticket Members ID.
      isArray: true
      name: members
    - description: Ticket DependedOn ID.
      isArray: true
      name: depends-on
    - description: Ticket DependedOnBy ID.
      isArray: true
      name: depended-on-by
    - description: Ticket RefersTo ID.
      isArray: true
      name: refers-to
    - description: Ticket ReferredToBy ID.
      isArray: true
      name: referred-to-by
    - description: Attachment to add to the ticket, given as Entry ID. Comma-separated values supported, e.g., entryID1,entryID2.
      isArray: true
      name: attachment
    - description: 'Ticket custom fields, given in format: field1=value1,field2=value2, e.g. IP=8.8.8.8,HowReported=Email. Note: the command does not create custom fields, these should be created on RTIR.'
      name: customfields
    description: Create new ticket on RTIR.
    name: rtir-create-ticket
    outputs:
    - contextPath: RTIR.Ticket.ID
      description: Ticket ID.
      type: number
    - contextPath: RTIR.Ticket.InitialPriority
      description: Ticket priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.Priority
      description: Ticket priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.FinalPriority
      description: Ticket final priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.Owner
      description: Ticket owner.
      type: string
    - contextPath: RTIR.Ticket.Subject
      description: Ticket subject.
      type: string
    - contextPath: RTIR.Ticket.Creator
      description: Ticker creator.
      type: string
  - arguments:
    - description: 'Ticket ID.'
      name: ticket-id
    - description: Ticket subject.
      name: subject
    - description: Ticket queue (Comma-separated values supported, e.g., General,Incident reports,Incidents).
      name: queue
      required: true
    - description: 'Ticket status.'
      name: status
    - description: Ticket creator.
      name: creator
    - description: Ticket priority (number in range 0-100).
      name: priority-equal-to
    - description: Ticket priority (number in range 0-100).
      name: priority-greater-than
    - description: Date after which the ticket was created, in format of YYYY-MM-DD, e.g. 2011-02-24.
      name: created-after
    - description: Date on which the ticket was created, in format of YYYY-MM-DD, e.g. 2011-02-24.
      name: created-on
    - description: Date before which the ticket was created, in format of YYYY-MM-DD, e.g. 2011-02-24.
      name: created-before
    - description: Ticker owner.
      name: owner
    - description: Ticket due date, in format of YYYY-MM-DD, e.g. 2011-02-24.
      name: due
    - defaultValue: '0'
      description: A limit for the max number of results that will return from the search. 0 means no limit, which is the default.
      name: results_limit
    description: Search for tickets on RTIR.
    name: rtir-search-ticket
    outputs:
    - contextPath: RTIR.Ticket.ID
      description: Ticket ID.
      type: number
    - contextPath: RTIR.Ticket.State
      description: Ticket state.
      type: string
    - contextPath: RTIR.Ticket.Creator
      description: Ticket creator.
      type: string
    - contextPath: RTIR.Ticket.Subject
      description: Ticket subject.
      type: string
    - contextPath: RTIR.Ticket.Created
      description: Ticket creation date.
      type: date
    - contextPath: RTIR.Ticket.Priority
      description: Ticket priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.InitialPriority
      description: Ticket initial priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.FinalPriority
      description: Ticket final priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.Queue
      description: Ticket queue.
      type: string
    - contextPath: RTIR.Ticket.Owner
      description: Ticket owner.
      type: string
    - contextPath: RTIR.Ticket.IP
      description: Ticket custom field - IP address.
      type: string
    - contextPath: RTIR.Ticket.HowReported
      description: Ticket custom field - How ticket was reported.
      type: string
    - contextPath: RTIR.Ticket.Customer
      description: Ticket custom field - Customer.
      type: string
  - arguments:
    - description: Ticket ID to close.
      name: ticket-id
      required: true
    description: Sets a ticket as resolved on RTIR.
    name: rtir-resolve-ticket
    outputs:
    - contextPath: RTIR.Ticket.ID
      description: Ticket ID.
      type: number
    - contextPath: RTIR.Ticket.State
      description: Ticket state.
      type: string
  - arguments:
    - description: Ticket ID.
      name: ticket-id
      required: true
    - description: Ticket subject.
      name: subject
    - description: Ticket priority, number in range 0-100.
      name: priority
    - description: Ticket final priority, number in range 0-100.
      name: final-priority
    - description: Ticket owner.
      name: owner
    - description: Ticket status.
      name: status
    - description: Ticket due date, in format of YYYY-MM-DD, e.g. 2011-02-24.
      name: due
    - description: Ticket MemberOF ID.
      isArray: true
      name: member-of
    - description: Ticket Members ID.
      isArray: true
      name: members
    - description: Ticket DependedOn ID.
      isArray: true
      name: depends-on
    - description: Ticket DependedOnBy ID.
      isArray: true
      name: depended-on-by
    - description: Ticket RefersTo ID.
      isArray: true
      name: refers-to
    - description: Ticket ReferredToBy ID.
      isArray: true
      name: referred-to-by
    - description: 'Ticket custom fields, given in format: field1=value1,field2=value2, e.g. IP=8.8.8.8,HowReported=Email. Note: the command does not create custom fields, these should be created on RTIR.'
      name: customfields
    description: Modify a ticket on RTIR.
    name: rtir-edit-ticket
    outputs:
    - contextPath: RTIR.Ticket.ID
      description: Ticket ID.
      type: number
    - contextPath: RTIR.Ticket.FinalPriority
      description: Ticket final priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.Priority
      description: Ticket priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.Owner
      description: Ticket owner.
      type: string
    - contextPath: RTIR.Ticket.State
      description: Ticket state.
      type: string
    - contextPath: RTIR.Ticket.Subject
      description: Ticket subject.
      type: string
  - arguments:
    - description: Ticket ID to get history of.
      name: ticket-id
      required: true
    description: Gets a list of all the history items for a given ticket.
    name: rtir-ticket-history
    outputs:
    - contextPath: RTIR.Ticket.ID
      description: Ticket ID.
      type: number
    - contextPath: RTIR.Ticket.History.Content
      description: Ticket history content.
      type: string
    - contextPath: RTIR.Ticket.History.Created
      description: Ticket history creation date.
      type: date
    - contextPath: RTIR.Ticket.History.Creator
      description: Ticket history creator.
      type: string
    - contextPath: RTIR.Ticket.History.Description
      description: Ticket history description.
      type: string
    - contextPath: RTIR.Ticket.History.NewValue
      description: Value updated in history transaction.
      type: string
  - arguments:
    - description: Ticket ID to get.
      name: ticket-id
      required: true
    description: Gets the data for a single ticket.
    name: rtir-get-ticket
    outputs:
    - contextPath: RTIR.Ticket.LinkedTo.ID
      description: Linked ticket ID.
      type: number
    - contextPath: RTIR.Ticket.ID
      description: Ticket ID.
      type: number
    - contextPath: RTIR.Ticket.State
      description: Ticket state.
      type: string
    - contextPath: RTIR.Ticket.Creator
      description: Ticket creator.
      type: string
    - contextPath: RTIR.Ticket.Subject
      description: Ticket subject.
      type: string
    - contextPath: RTIR.Ticket.Created
      description: Ticket creation date.
      type: date
    - contextPath: RTIR.Ticket.Priority
      description: Ticket priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.InitialPriority
      description: Ticket initial priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.FinalPriority
      description: Ticket final priority (0-100).
      type: number
    - contextPath: RTIR.Ticket.Queue
      description: Ticket queue.
      type: string
    - contextPath: RTIR.Ticket.Owner
      description: Ticket owner.
      type: string
    - contextPath: RTIR.Ticket.IP
      description: Ticket custom field - IP address.
      type: string
    - contextPath: RTIR.Ticket.HowReported
      description: Ticket custom field - How ticket was reported.
      type: string
    - contextPath: RTIR.Ticket.Customer
      description: Ticket custom field - Customer.
      type: string
  - arguments:
    - description: Ticket ID to get attachments of.
      name: ticket-id
      required: true
    description: Gets a list of all attachments details and data content related to the ticket.
    name: rtir-ticket-attachments
    outputs:
    - contextPath: RTIR.Ticket.ID
      description: Ticket ID.
      type: number
    - contextPath: RTIR.Ticket.Attachment.ID
      description: Attachment ID.
      type: number
    - contextPath: RTIR.Ticket.Attachment.Name
      description: Attachment file name.
      type: string
    - contextPath: RTIR.Ticket.Attachment.Size
      description: Attachment file size.
      type: string
    - contextPath: RTIR.Ticket.Attachment.Type
      description: Attachment file type.
      type: string
    - contextPath: File.EntryID
      description: Demisto entry ID of attachment.
      type: string
    - contextPath: File.Size
      description: File size.
      type: number
    - contextPath: File.SHA1
      description: File SHA1.
      type: string
    - contextPath: File.SHA256
      description: File SHA256.
      type: string
    - contextPath: File.Name
      description: File name.
      type: string
    - contextPath: File.SSDeep
      description: File SSDeep.
      type: string
    - contextPath: File.Info
      description: File type information.
      type: string
    - contextPath: File.Type
      description: File type.
      type: string
    - contextPath: File.MD5
      description: File MD5.
      type: string
    - contextPath: File.Extension
      description: File extension.
      type: string
  - arguments:
    - description: Ticket ID to add comment to.
      name: ticket-id
      required: true
    - description: Comment text.
      name: text
      required: true
    - description: Attachment to add to the ticket, given as Entry ID. Comma-separated values supported, e.g., entryID1,entryID2.
      isArray: true
      name: attachment
    description: Add a comment to an existing ticket.
    name: rtir-add-comment
  - arguments:
    - description: Ticket ID to send the reply to the user.
      name: ticket-id
      required: true
    - description: reply text.
      name: text
      required: true
    - description: Email of the user to send the reply.
      isArray: true
      name: cc
    description: Send a reply from an existing ticket to the user.
    name: rtir-add-reply
  isfetch: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
tests:
- RTIR Test
fromversion: 5.0.0