As it's technically an extension, RTIR builds on all the features of RT and provides pre-configured queues and workflows designed for incident response teams. It's the tool of choice for many CERT and CSIRT teams all over the globe.
RTIR has tools to correlate key data from incident reports, both from people and automated tools, to find patterns and link multiple incident report with a common root cause incident.
Manage communication to multiple interested parties including reporters, counterparts at other security teams collaborating on responses, and other internal teams coordinating countermeasures.
