Wow. RTIR looks just like what I need. It's a full-blown trouble ticket reporting system that's been customized to handle Incident Response duties. It has a fully scriptable engine, and does neat things like automatically correlate IP addresses between incidents or investigations, integrate whois/traceroute lookups and provide workflow management. You can even add custom scripts into it to extend it to features in your own environment. This looks nice to me. Does anyone else know of anything similar?