Add Rust incident notification workflow

Author: ewilhelm1979-netizen

Makefile

@@ -78,6 +78,7 @@ rust-smoke:
 	curl -fsS -b "$$cookie_file" "$$url/dashboard/" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/admin/users/" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/imports/" >/dev/null; \
+	curl -fsS -b "$$cookie_file" "$$url/incidents/" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/api/v1/accounts/users" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/api/v1/accounts/roles" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/api/v1/accounts/groups" >/dev/null; \
@@ -88,6 +89,7 @@ rust-smoke:
 	curl -fsS "$$url/dashboard/?tenant_id=1&user_id=1" >/dev/null; \
 	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/catalog/domains" >/dev/null; \
 	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/requirements" >/dev/null; \
+	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/incidents" >/dev/null; \
 	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/product-security/overview" >/dev/null; \
 	echo "Rust smoke OK: $$url"
 

README.md

@@ -1,6 +1,6 @@
 # ISCY V23.7.2 / Rust 0.3.0
 
-ISCY ist eine ISMS-/Cybersecurity-Plattform mit ISO 27001-, NIS2- und KRITIS-Unterstuetzung, Product Security, Zero-Trust-Agent-Posture, lokalem CVE-Enrichment und lokalem LLM-Betrieb.
+ISCY ist eine ISMS-/Cybersecurity-Plattform mit ISO 27001-, NIS2- und KRITIS-Unterstuetzung, Incident-/Meldeworkflow, Product Security, Zero-Trust-Agent-Posture, lokalem CVE-Enrichment und lokalem LLM-Betrieb.
 
 Der Runtime-Cutover nach Rust ist abgeschlossen: Die produktive Anwendung laeuft ueber den Rust-Axum-Service in `rust/iscy-backend`. Die fruehere Django/Python-Anwendung, ihre Templates, Settings, Requirements und Startpfade wurden aus dem Repository entfernt.
 
@@ -84,6 +84,7 @@ Das Backend stellt serverseitige Weboberflaechen und APIs fuer die migrierten Pr
 - `/assessments/`
 - `/organizations/`
 - `/risks/`
+- `/incidents/`
 - `/evidence/`
 - `/reports/`
 - `/roadmap/`

docs/ISCY_Handbuch.md

@@ -549,7 +549,19 @@ Hier wird aus einer technischen Schwachstellenmeldung eine geschaeftlich nutzbar
 4. Risiko und Vulnerability automatisch verknuepfen
 5. Massnahmen ueber Roadmap oder Behandlung steuern
 
-### 6.5 SOC-Playbook fuer Phishing- und aehnliche Incident-Faelle
+### 6.5 Incident- und NIS2-Meldeworkflow
+
+Die Rust-Webroute `/incidents/` fuehrt operative Sicherheitsvorfaelle als mandantenfaehige Fallakten. Ein Incident kann Reporter, Owner, Risiko, Asset und Prozess referenzieren und enthaelt Status, Severity, Stakeholder-Zusammenfassung sowie Behoerden- oder Case-Referenz.
+
+Wenn ein Incident als NIS2-meldepflichtig markiert wird, berechnet ISCY die relevanten Fristen aus dem Erkennungszeitpunkt:
+
+1. 24h-Fruehwarnung
+2. 72h-Meldung
+3. Abschlussbericht nach 30 Tagen
+
+Die Uebersicht zeigt offene Faelle, NIS2-relevante Faelle und ueberfaellige Meldeschritte. Gesendete Meldungen koennen ueber die API als Zeitstempel gepflegt werden.
+
+### 6.6 SOC-Playbook fuer Phishing- und aehnliche Incident-Faelle
 
 Empfohlene Kette fuer die operative Bearbeitung:
 
@@ -574,7 +586,7 @@ Empfohlene Kette fuer die operative Bearbeitung:
 
 Merksatz: Erst verstehen, dann bewerten, dann eindaemmen, dann eskalieren - wenn Risiko oder Komplexitaet es verlangen.
 
-### 6.6 ISCY lokal starten
+### 6.7 ISCY lokal starten
 
 Einfachster lokaler Start:
 

docs/RUST_CUTOVER_STATUS.md

@@ -1,6 +1,6 @@
 # ISCY Rust-Cutover-Status
 
-Stand: 2026-06-07
+Stand: 2026-06-08
 
 ## Kurzfassung
 
@@ -24,6 +24,7 @@ ISCY startet produktiv und lokal ueber den Rust-Axum-Service in `rust/iscy-backe
 - Assessments
 - Organizations
 - Risks
+- Incidents inklusive NIS2-Meldefristen und Fallakten
 - Evidence inklusive Upload
 - Reports
 - Roadmap

rust/iscy-backend/src/db_admin.rs

@@ -72,6 +72,11 @@ const MIGRATIONS: &[Migration] = &[
         sqlite_sql: SQLITE_AGENT_ENROLLMENT_HARDENING_SCHEMA,
         postgres_sql: POSTGRES_AGENT_ENROLLMENT_HARDENING_SCHEMA,
     },
+    Migration {
+        version: "0009_rust_incident_core",
+        sqlite_sql: SQLITE_INCIDENT_SCHEMA,
+        postgres_sql: POSTGRES_INCIDENT_SCHEMA,
+    },
 ];
 
 const SQLITE_CATALOG_REQUIREMENTS_SEED: &str =
@@ -320,6 +325,80 @@ CREATE INDEX IF NOT EXISTS idx_zero_trust_agent_token_hash ON zero_trust_agent_e
 CREATE INDEX IF NOT EXISTS idx_zero_trust_agent_device_auth ON zero_trust_agent_device(tenant_id, auth_model, enrollment_status);
 "#;
 
+const SQLITE_INCIDENT_SCHEMA: &str = r#"
+CREATE TABLE IF NOT EXISTS incidents_incident (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    tenant_id INTEGER NOT NULL,
+    reporter_id INTEGER NULL,
+    owner_id INTEGER NULL,
+    related_risk_id INTEGER NULL,
+    related_asset_id INTEGER NULL,
+    related_process_id INTEGER NULL,
+    title varchar(255) NOT NULL,
+    summary TEXT NOT NULL DEFAULT '',
+    severity varchar(16) NOT NULL DEFAULT 'MEDIUM',
+    status varchar(32) NOT NULL DEFAULT 'TRIAGE',
+    detected_at TEXT NULL,
+    confirmed_at TEXT NULL,
+    contained_at TEXT NULL,
+    resolved_at TEXT NULL,
+    nis2_reportable bool NOT NULL DEFAULT 0,
+    early_warning_due_at TEXT NULL,
+    early_warning_sent_at TEXT NULL,
+    notification_due_at TEXT NULL,
+    notification_sent_at TEXT NULL,
+    final_report_due_at TEXT NULL,
+    final_report_sent_at TEXT NULL,
+    authority_reference varchar(255) NOT NULL DEFAULT '',
+    stakeholder_summary TEXT NOT NULL DEFAULT '',
+    lessons_learned TEXT NOT NULL DEFAULT '',
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
+CREATE INDEX IF NOT EXISTS idx_incidents_tenant_status ON incidents_incident(tenant_id, status, severity);
+CREATE INDEX IF NOT EXISTS idx_incidents_tenant_nis2 ON incidents_incident(tenant_id, nis2_reportable, notification_due_at);
+CREATE INDEX IF NOT EXISTS idx_incidents_related_risk ON incidents_incident(tenant_id, related_risk_id);
+CREATE INDEX IF NOT EXISTS idx_incidents_related_asset ON incidents_incident(tenant_id, related_asset_id);
+CREATE INDEX IF NOT EXISTS idx_incidents_related_process ON incidents_incident(tenant_id, related_process_id);
+"#;
+
+const POSTGRES_INCIDENT_SCHEMA: &str = r#"
+CREATE TABLE IF NOT EXISTS incidents_incident (
+    id BIGSERIAL PRIMARY KEY,
+    tenant_id BIGINT NOT NULL,
+    reporter_id BIGINT NULL,
+    owner_id BIGINT NULL,
+    related_risk_id BIGINT NULL,
+    related_asset_id BIGINT NULL,
+    related_process_id BIGINT NULL,
+    title varchar(255) NOT NULL,
+    summary TEXT NOT NULL DEFAULT '',
+    severity varchar(16) NOT NULL DEFAULT 'MEDIUM',
+    status varchar(32) NOT NULL DEFAULT 'TRIAGE',
+    detected_at TEXT NULL,
+    confirmed_at TEXT NULL,
+    contained_at TEXT NULL,
+    resolved_at TEXT NULL,
+    nis2_reportable BOOLEAN NOT NULL DEFAULT FALSE,
+    early_warning_due_at TEXT NULL,
+    early_warning_sent_at TEXT NULL,
+    notification_due_at TEXT NULL,
+    notification_sent_at TEXT NULL,
+    final_report_due_at TEXT NULL,
+    final_report_sent_at TEXT NULL,
+    authority_reference varchar(255) NOT NULL DEFAULT '',
+    stakeholder_summary TEXT NOT NULL DEFAULT '',
+    lessons_learned TEXT NOT NULL DEFAULT '',
+    created_at TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP)::text,
+    updated_at TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP)::text
+);
+CREATE INDEX IF NOT EXISTS idx_incidents_tenant_status ON incidents_incident(tenant_id, status, severity);
+CREATE INDEX IF NOT EXISTS idx_incidents_tenant_nis2 ON incidents_incident(tenant_id, nis2_reportable, notification_due_at);
+CREATE INDEX IF NOT EXISTS idx_incidents_related_risk ON incidents_incident(tenant_id, related_risk_id);
+CREATE INDEX IF NOT EXISTS idx_incidents_related_asset ON incidents_incident(tenant_id, related_asset_id);
+CREATE INDEX IF NOT EXISTS idx_incidents_related_process ON incidents_incident(tenant_id, related_process_id);
+"#;
+
 const SQLITE_AUTH_RBAC_SCHEMA: &str = r#"
 CREATE TABLE IF NOT EXISTS accounts_role (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -2137,6 +2216,21 @@ INSERT OR IGNORE INTO risks_risk (
     'Roll out phishing-resistant MFA', '2026-06-30', NULL, NULL, '2026-07-15',
     '2026-04-22T10:00:00Z', '2026-04-22T10:00:00Z'
 );
+INSERT OR IGNORE INTO incidents_incident (
+    id, tenant_id, reporter_id, owner_id, related_risk_id, related_asset_id, related_process_id,
+    title, summary, severity, status, detected_at, confirmed_at, contained_at, resolved_at,
+    nis2_reportable, early_warning_due_at, early_warning_sent_at, notification_due_at,
+    notification_sent_at, final_report_due_at, final_report_sent_at, authority_reference,
+    stakeholder_summary, lessons_learned, created_at, updated_at
+) VALUES (
+    1, 1, 1, 1, 1, 1, 1,
+    'Credential phishing campaign', 'Demo incident with NIS2 notification tracking.',
+    'HIGH', 'CONFIRMED', '2026-04-22T10:00:00Z', '2026-04-22T11:00:00Z', NULL, NULL,
+    1, '2026-04-23T10:00:00Z', NULL, '2026-04-25T10:00:00Z',
+    NULL, '2026-05-22T10:00:00Z', NULL, '',
+    'Credential phishing affects the customer portal operating process.',
+    '', '2026-04-22T10:00:00Z', '2026-04-22T11:00:00Z'
+);
 INSERT OR IGNORE INTO wizard_assessmentsession (
     id, tenant_id, started_by_id, assessment_type, status, current_step, applicability_result,
     applicability_reasoning, executive_summary, progress_percent, completed_at, created_at, updated_at
@@ -2443,6 +2537,21 @@ INSERT INTO risks_risk (
     'Roll out phishing-resistant MFA', '2026-06-30', NULL, NULL, '2026-07-15',
     '2026-04-22T10:00:00Z', '2026-04-22T10:00:00Z'
 ) ON CONFLICT (id) DO NOTHING;
+INSERT INTO incidents_incident (
+    id, tenant_id, reporter_id, owner_id, related_risk_id, related_asset_id, related_process_id,
+    title, summary, severity, status, detected_at, confirmed_at, contained_at, resolved_at,
+    nis2_reportable, early_warning_due_at, early_warning_sent_at, notification_due_at,
+    notification_sent_at, final_report_due_at, final_report_sent_at, authority_reference,
+    stakeholder_summary, lessons_learned, created_at, updated_at
+) VALUES (
+    1, 1, 1, 1, 1, 1, 1,
+    'Credential phishing campaign', 'Demo incident with NIS2 notification tracking.',
+    'HIGH', 'CONFIRMED', '2026-04-22T10:00:00Z', '2026-04-22T11:00:00Z', NULL, NULL,
+    TRUE, '2026-04-23T10:00:00Z', NULL, '2026-04-25T10:00:00Z',
+    NULL, '2026-05-22T10:00:00Z', NULL, '',
+    'Credential phishing affects the customer portal operating process.',
+    '', '2026-04-22T10:00:00Z', '2026-04-22T11:00:00Z'
+) ON CONFLICT (id) DO NOTHING;
 INSERT INTO wizard_assessmentsession (
     id, tenant_id, started_by_id, assessment_type, status, current_step, applicability_result,
     applicability_reasoning, executive_summary, progress_percent, completed_at, created_at, updated_at