DETAILS http://code.google.com/p/perl-xml-iodef/updates/list This module takes in and processes IODEF XML objects (pgp helps compress the xml FYI, keeps SMTP from breaking it up with \n's) and maps them to customfields who's description matches _IODEF_... (see etc/initialdata for an included example). SYNOPSIS # to map the IODEF XML to a custom field, set the custom field's "description" to it's IODEF (XML::IODEF) representation of the xml path prepended with _IODEF_ # these will be mapped when the IODEF_ProcessMessage script runs during a TicketCreate transaction # see lib/RT/Action/IODEF_ProcessMessage.pm Description _IODEF_IncidentDescription Restriction: _IODEF_Incidentrestriction Address: _IODEF_IncidentEventDataFlowSystemNodeAddress Severity: _IODEF_IncidentAssessmentImpactseverity Impact: _IODEF_IncidentAssessmentImpact Service Protocol: _IODEF_IncidentEventDataFlowSystemServiceip_protocol Service Portlist: _IODEF_IncidentEventDataFlowSystemServicePortlist # and so on... # example taken from html/IODEF/IODEF.html <%INIT> use RT::Ticket; my $Ticket = RT::Ticket->new($session{'CurrentUser'}); $Ticket->Load($ARGS{'id'}); my $xml = $Ticket->IODEF(); $r->content_type('application/xml'); $xml = $xml->out(); $m->out($xml); $m->abort(); <%ARGS> $id => undef INSTALLATION 1. #> perl Makefile.PL 2. #> make 3. #> make install 4. #> make initdb 5. #> vi /opt/rt3/etc/RT_SiteConfig.pm Set(@Plugins,(qw(RT::IODEF))); 6. #> /etc/init.d/httpd reload FOR USE WITH RT+IR (Incident Response Plugin) Apply the following to your 'Incident Reports' queue: Description => 'zIODEF_ProcessMessage' Queue => ['Incident Reports'] ScripCondition => 'On Create' ScripAction => 'IODEF ProcessMessage' Template => 'Blank'