Request Tracker for Incident Response review
A customizable, self-hosted case workflow for security response teams.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Security response teams handling reports, investigations, and countermeasures may find RTIR a good fit when they want cases organized around configurable queues. Request Tracker for Incident Response is an open-source extension that runs on Request Tracker, with preconfigured queues for incident reports, incidents, investigations, and countermeasures. It links related tickets so activity can be tracked across an incident and its investigation or countermeasures. Dashboards, configurable listings, custom fields, metadata-based searches, and reports give teams ways to shape their case workflow. This is a focused incident-handling system rather than a complete incident communications suite.
Workflow depth is its clearest strength. Teams can apply cascading status changes across linked tickets, perform bulk operations, script ticket creation, and configure escalations and automated notifications. Ticket audit history tracks changes. Activity reports are available in HTML, text, and spreadsheet formats, while the RT API can support automated data feeds. Listed integrations include Splunk, ArcSight, Nagios, Squil, Qualys, Zapier, Active Directory, and SAML. These capabilities suit teams that need structured, traceable response queues and can adapt Request Tracker to their processes.
RTIR can be self-hosted, and the vendor also includes it in managed Cloud RT plans. According to the vendor's pricing page, Cloud RT's Starter plan is $15 per user per month billed annually, with 250 tickets per month and 10 GB secure storage. Business is $29 with 1,000 tickets, 30 GB, email support, and 7-day backups; Growth is $39 with 5,000 tickets, 75 GB, SSO, data residency, and failover. Enterprise offers unlimited tickets and 1 TB or more storage, with contact-sales pricing. Choose RTIR for customizable queues and linked case handling; look elsewhere if your incident process depends on verified status pages, mobile apps, or postmortems.
Request Tracker for Incident Response pros and cons
- Where it wins
- Preconfigured queues link reports, incidents, investigations, and countermeasures
- Automations include cascading status changes, escalations, and notifications
- RT API, integrations, reports, and ticket audit history support response workflows
- Where it doesn't
- Self-hosted deployment requires teams to run Request Tracker
- Cloud RT starts at $15 per user per month, billed annually
- No verified status pages, mobile apps, or postmortems
Request Tracker for Incident Response fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update