Add incident runbooks and export formats

Author: ewilhelm1979-netizen

.github/workflows/ci.yml

@@ -85,17 +85,21 @@ jobs:
           curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/incidents/" >/dev/null
           curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/incidents/1" >/dev/null
           curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/incidents/1/nis2-export" >/dev/null
+          curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/incidents/1/nis2-export.html" >/dev/null
+          curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/incidents/1/nis2-export.pdf" >/dev/null
           curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/api/v1/accounts/users" >/dev/null
           curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/api/v1/accounts/roles" >/dev/null
           curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/api/v1/accounts/groups" >/dev/null
           curl -fsS -b "$cookie_file" "$RUST_BACKEND_URL/api/v1/accounts/permissions" >/dev/null
           curl -fsS -b "$cookie_file" -F import_type='processes' -F "file=@$import_file;filename=preview.csv;type=text/csv" "$RUST_BACKEND_URL/api/v1/import-center/preview" >/dev/null
           curl -fsS -b "$cookie_file" -H "content-type: application/json" -d '{"import_type":"business_units","replace_existing":false,"csv_data":"name\nRust Smoke Import"}' "$RUST_BACKEND_URL/api/v1/import-center/csv" >/dev/null
-          curl -fsS -b "$cookie_file" -F title='Rust Smoke Evidence' -F status='SUBMITTED' -F session_id='1' -F requirement_id='1' -F "file=@$evidence_file;filename=evidence.txt;type=text/plain" "$RUST_BACKEND_URL/api/v1/evidence/uploads" >/dev/null
+          curl -fsS -b "$cookie_file" -F title='Rust Smoke Evidence' -F status='SUBMITTED' -F session_id='1' -F requirement_id='1' -F incident_id='1' -F "file=@$evidence_file;filename=evidence.txt;type=text/plain" "$RUST_BACKEND_URL/api/v1/evidence/uploads" >/dev/null
           curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$RUST_BACKEND_URL/api/v1/catalog/domains" >/dev/null
           curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$RUST_BACKEND_URL/api/v1/requirements" >/dev/null
           curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$RUST_BACKEND_URL/api/v1/incidents" >/dev/null
           curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$RUST_BACKEND_URL/api/v1/incidents/1/nis2-export" >/dev/null
+          curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$RUST_BACKEND_URL/api/v1/incidents/1/nis2-export.html" >/dev/null
+          curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$RUST_BACKEND_URL/api/v1/incidents/1/nis2-export.pdf" >/dev/null
           curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$RUST_BACKEND_URL/api/v1/product-security/overview" >/dev/null
 
   docker-config:

Makefile

@@ -81,18 +81,22 @@ rust-smoke:
 	curl -fsS -b "$$cookie_file" "$$url/incidents/" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/incidents/1" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/incidents/1/nis2-export" >/dev/null; \
+	curl -fsS -b "$$cookie_file" "$$url/incidents/1/nis2-export.html" >/dev/null; \
+	curl -fsS -b "$$cookie_file" "$$url/incidents/1/nis2-export.pdf" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/api/v1/accounts/users" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/api/v1/accounts/roles" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/api/v1/accounts/groups" >/dev/null; \
 	curl -fsS -b "$$cookie_file" "$$url/api/v1/accounts/permissions" >/dev/null; \
 	curl -fsS -b "$$cookie_file" -F import_type='processes' -F "file=@$$import_file;filename=preview.csv;type=text/csv" "$$url/api/v1/import-center/preview" >/dev/null; \
 	curl -fsS -b "$$cookie_file" -H "content-type: application/json" -d '{"import_type":"business_units","replace_existing":false,"csv_data":"name\nRust Smoke Import"}' "$$url/api/v1/import-center/csv" >/dev/null; \
-	curl -fsS -b "$$cookie_file" -F title='Rust Smoke Evidence' -F status='SUBMITTED' -F session_id='1' -F requirement_id='1' -F "file=@$$evidence_file;filename=evidence.txt;type=text/plain" "$$url/api/v1/evidence/uploads" >/dev/null; \
+	curl -fsS -b "$$cookie_file" -F title='Rust Smoke Evidence' -F status='SUBMITTED' -F session_id='1' -F requirement_id='1' -F incident_id='1' -F "file=@$$evidence_file;filename=evidence.txt;type=text/plain" "$$url/api/v1/evidence/uploads" >/dev/null; \
 	curl -fsS "$$url/dashboard/?tenant_id=1&user_id=1" >/dev/null; \
 	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/catalog/domains" >/dev/null; \
 	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/requirements" >/dev/null; \
 	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/incidents" >/dev/null; \
 	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/incidents/1/nis2-export" >/dev/null; \
+	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/incidents/1/nis2-export.html" >/dev/null; \
+	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/incidents/1/nis2-export.pdf" >/dev/null; \
 	curl -fsS -H "x-iscy-tenant-id: 1" -H "x-iscy-user-id: 1" "$$url/api/v1/product-security/overview" >/dev/null; \
 	echo "Rust smoke OK: $$url"
 

README.md

@@ -95,7 +95,7 @@ Das Backend stellt serverseitige Weboberflaechen und APIs fuer die migrierten Pr
 - `/cves/`
 - `/admin/users/`
 
-Incidents werden als Rust-Fallakten unter `/incidents/` gefuehrt. Detailseiten unter `/incidents/{id}` erlauben die Bearbeitung von Status, Severity, Meldezeitpunkten und Behoerdenreferenz; das NIS2-Meldepaket kann als Markdown ueber `/incidents/{id}/nis2-export` oder `/api/v1/incidents/{id}/nis2-export` exportiert werden.
+Incidents werden als Rust-Fallakten unter `/incidents/` gefuehrt. Detailseiten unter `/incidents/{id}` erlauben die Bearbeitung von Typ, Runbook, Status, Severity, Meldezeitpunkten und Behoerdenreferenz; verknuepfte Evidence wird direkt in der Fallakte angezeigt. Das NIS2-Meldepaket kann als Markdown, HTML oder PDF ueber `/incidents/{id}/nis2-export`, `/incidents/{id}/nis2-export.html`, `/incidents/{id}/nis2-export.pdf` sowie die entsprechenden `/api/v1/incidents/{id}/...` Endpunkte exportiert werden.
 
 ## Zero-Trust Agent
 

docs/ISCY_Handbuch.md

@@ -551,7 +551,7 @@ Hier wird aus einer technischen Schwachstellenmeldung eine geschaeftlich nutzbar
 
 ### 6.5 Incident- und NIS2-Meldeworkflow
 
-Die Rust-Webroute `/incidents/` fuehrt operative Sicherheitsvorfaelle als mandantenfaehige Fallakten. Ein Incident kann Reporter, Owner, Risiko, Asset und Prozess referenzieren und enthaelt Status, Severity, Stakeholder-Zusammenfassung sowie Behoerden- oder Case-Referenz.
+Die Rust-Webroute `/incidents/` fuehrt operative Sicherheitsvorfaelle als mandantenfaehige Fallakten. Ein Incident kann Reporter, Owner, Risiko, Asset und Prozess referenzieren und enthaelt Typ, Runbook, Status, Severity, Stakeholder-Zusammenfassung sowie Behoerden- oder Case-Referenz.
 
 Wenn ein Incident als NIS2-meldepflichtig markiert wird, berechnet ISCY die relevanten Fristen aus dem Erkennungszeitpunkt:
 
@@ -561,7 +561,7 @@ Wenn ein Incident als NIS2-meldepflichtig markiert wird, berechnet ISCY die rele
 
 Die Uebersicht zeigt offene Faelle, NIS2-relevante Faelle und ueberfaellige Meldeschritte. Gesendete Meldungen koennen ueber die API als Zeitstempel gepflegt werden.
 
-Die Detailseite `/incidents/{id}` dient als operative Fallakte. Dort koennen berechtigte Rollen Status, Severity, Behoerdenreferenz, Zeitlinie und Meldezeitpunkte pflegen. Das Markdown-Meldepaket unter `/incidents/{id}/nis2-export` buendelt Fallakte, betroffene Bezuege, 24h-/72h-/30-Tage-Fristen, Stakeholder-Zusammenfassung und Lessons Learned fuer Audit- oder Meldezwecke.
+Die Detailseite `/incidents/{id}` dient als operative Fallakte. Dort koennen berechtigte Rollen Typ, Runbook, Status, Severity, Behoerdenreferenz, Zeitlinie und Meldezeitpunkte pflegen. Evidence-Uploads koennen ueber `incident_id` direkt an einen Incident gekoppelt werden und erscheinen in der Fallakte. Das Meldepaket unter `/incidents/{id}/nis2-export` buendelt Fallakte, Runbook, verknuepfte Evidence, betroffene Bezuege, 24h-/72h-/30-Tage-Fristen, Stakeholder-Zusammenfassung und Lessons Learned; zusaetzlich stehen HTML und PDF ueber `/incidents/{id}/nis2-export.html` und `/incidents/{id}/nis2-export.pdf` bereit.
 
 ### 6.6 SOC-Playbook fuer Phishing- und aehnliche Incident-Faelle
 

docs/RUST_CUTOVER_STATUS.md

@@ -24,8 +24,8 @@ ISCY startet produktiv und lokal ueber den Rust-Axum-Service in `rust/iscy-backe
 - Assessments
 - Organizations
 - Risks
-- Incidents inklusive NIS2-Meldefristen, Fallakten, Detailbearbeitung und Markdown-Meldepaket
-- Evidence inklusive Upload
+- Incidents inklusive NIS2-Meldefristen, Fallakten, Detailbearbeitung, Runbooks und Markdown-/HTML-/PDF-Meldepaket
+- Evidence inklusive Upload und Incident-Verknuepfung
 - Reports
 - Roadmap
 - Assets

rust/iscy-backend/src/db_admin.rs

@@ -77,6 +77,11 @@ const MIGRATIONS: &[Migration] = &[
         sqlite_sql: SQLITE_INCIDENT_SCHEMA,
         postgres_sql: POSTGRES_INCIDENT_SCHEMA,
     },
+    Migration {
+        version: "0010_rust_incident_runbooks_evidence_exports",
+        sqlite_sql: SQLITE_INCIDENT_RUNBOOK_EVIDENCE_EXPORT_SCHEMA,
+        postgres_sql: POSTGRES_INCIDENT_RUNBOOK_EVIDENCE_EXPORT_SCHEMA,
+    },
 ];
 
 const SQLITE_CATALOG_REQUIREMENTS_SEED: &str =
@@ -399,6 +404,34 @@ CREATE INDEX IF NOT EXISTS idx_incidents_related_asset ON incidents_incident(ten
 CREATE INDEX IF NOT EXISTS idx_incidents_related_process ON incidents_incident(tenant_id, related_process_id);
 "#;
 
+const SQLITE_INCIDENT_RUNBOOK_EVIDENCE_EXPORT_SCHEMA: &str = r#"
+ALTER TABLE incidents_incident ADD COLUMN incident_type varchar(32) NOT NULL DEFAULT 'GENERAL';
+ALTER TABLE incidents_incident ADD COLUMN runbook_template TEXT NOT NULL DEFAULT '';
+ALTER TABLE evidence_evidenceitem ADD COLUMN incident_id INTEGER NULL;
+CREATE INDEX IF NOT EXISTS idx_evidence_items_incident ON evidence_evidenceitem(tenant_id, incident_id);
+UPDATE incidents_incident
+SET incident_type = 'PHISHING',
+    runbook_template = '1. Scope erfassen; 2. Eindaemmung durchfuehren; 3. Meldung bewerten'
+WHERE runbook_template = '' AND LOWER(title) LIKE '%phishing%';
+UPDATE incidents_incident
+SET runbook_template = '1. Scope erfassen; 2. Eindaemmung durchfuehren; 3. Kommunikation abstimmen; 4. Lessons Learned dokumentieren'
+WHERE runbook_template = '';
+"#;
+
+const POSTGRES_INCIDENT_RUNBOOK_EVIDENCE_EXPORT_SCHEMA: &str = r#"
+ALTER TABLE incidents_incident ADD COLUMN IF NOT EXISTS incident_type varchar(32) NOT NULL DEFAULT 'GENERAL';
+ALTER TABLE incidents_incident ADD COLUMN IF NOT EXISTS runbook_template TEXT NOT NULL DEFAULT '';
+ALTER TABLE evidence_evidenceitem ADD COLUMN IF NOT EXISTS incident_id BIGINT NULL;
+CREATE INDEX IF NOT EXISTS idx_evidence_items_incident ON evidence_evidenceitem(tenant_id, incident_id);
+UPDATE incidents_incident
+SET incident_type = 'PHISHING',
+    runbook_template = '1. Scope erfassen; 2. Eindaemmung durchfuehren; 3. Meldung bewerten'
+WHERE runbook_template = '' AND LOWER(title) LIKE '%phishing%';
+UPDATE incidents_incident
+SET runbook_template = '1. Scope erfassen; 2. Eindaemmung durchfuehren; 3. Kommunikation abstimmen; 4. Lessons Learned dokumentieren'
+WHERE runbook_template = '';
+"#;
+
 const SQLITE_AUTH_RBAC_SCHEMA: &str = r#"
 CREATE TABLE IF NOT EXISTS accounts_role (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -2218,13 +2251,14 @@ INSERT OR IGNORE INTO risks_risk (
 );
 INSERT OR IGNORE INTO incidents_incident (
     id, tenant_id, reporter_id, owner_id, related_risk_id, related_asset_id, related_process_id,
-    title, summary, severity, status, detected_at, confirmed_at, contained_at, resolved_at,
+    title, summary, incident_type, runbook_template, severity, status, detected_at, confirmed_at, contained_at, resolved_at,
     nis2_reportable, early_warning_due_at, early_warning_sent_at, notification_due_at,
     notification_sent_at, final_report_due_at, final_report_sent_at, authority_reference,
     stakeholder_summary, lessons_learned, created_at, updated_at
 ) VALUES (
     1, 1, 1, 1, 1, 1, 1,
     'Credential phishing campaign', 'Demo incident with NIS2 notification tracking.',
+    'PHISHING', '1. Scope erfassen; 2. Eindaemmung durchfuehren; 3. Meldung bewerten',
     'HIGH', 'CONFIRMED', '2026-04-22T10:00:00Z', '2026-04-22T11:00:00Z', NULL, NULL,
     1, '2026-04-23T10:00:00Z', NULL, '2026-04-25T10:00:00Z',
     NULL, '2026-05-22T10:00:00Z', NULL, '',
@@ -2265,9 +2299,9 @@ INSERT OR IGNORE INTO requirements_app_requirement (
 );
 INSERT OR IGNORE INTO evidence_evidenceitem (
     id, tenant_id, session_id, domain_id, measure_id, requirement_id, title, description,
-    linked_requirement, file, status, owner_id, review_notes, reviewed_by_id, reviewed_at, created_at, updated_at
+    incident_id, linked_requirement, file, status, owner_id, review_notes, reviewed_by_id, reviewed_at, created_at, updated_at
 ) VALUES (
-    1, 1, 1, NULL, NULL, 1, 'MFA rollout evidence', 'Initial MFA rollout evidence.',
+    1, 1, 1, NULL, NULL, 1, 'MFA rollout evidence', 'Initial MFA rollout evidence.', 1,
     'NIS2-21-MFA', NULL, 'APPROVED', 1, 'Looks ready for demo.', 1, '2026-04-22T10:00:00Z',
     '2026-04-22T10:00:00Z', '2026-04-22T10:00:00Z'
 );
@@ -2539,13 +2573,14 @@ INSERT INTO risks_risk (
 ) ON CONFLICT (id) DO NOTHING;
 INSERT INTO incidents_incident (
     id, tenant_id, reporter_id, owner_id, related_risk_id, related_asset_id, related_process_id,
-    title, summary, severity, status, detected_at, confirmed_at, contained_at, resolved_at,
+    title, summary, incident_type, runbook_template, severity, status, detected_at, confirmed_at, contained_at, resolved_at,
     nis2_reportable, early_warning_due_at, early_warning_sent_at, notification_due_at,
     notification_sent_at, final_report_due_at, final_report_sent_at, authority_reference,
     stakeholder_summary, lessons_learned, created_at, updated_at
 ) VALUES (
     1, 1, 1, 1, 1, 1, 1,
     'Credential phishing campaign', 'Demo incident with NIS2 notification tracking.',
+    'PHISHING', '1. Scope erfassen; 2. Eindaemmung durchfuehren; 3. Meldung bewerten',
     'HIGH', 'CONFIRMED', '2026-04-22T10:00:00Z', '2026-04-22T11:00:00Z', NULL, NULL,
     TRUE, '2026-04-23T10:00:00Z', NULL, '2026-04-25T10:00:00Z',
     NULL, '2026-05-22T10:00:00Z', NULL, '',
@@ -2586,9 +2621,9 @@ INSERT INTO requirements_app_requirement (
 ) ON CONFLICT (id) DO NOTHING;
 INSERT INTO evidence_evidenceitem (
     id, tenant_id, session_id, domain_id, measure_id, requirement_id, title, description,
-    linked_requirement, file, status, owner_id, review_notes, reviewed_by_id, reviewed_at, created_at, updated_at
+    incident_id, linked_requirement, file, status, owner_id, review_notes, reviewed_by_id, reviewed_at, created_at, updated_at
 ) VALUES (
-    1, 1, 1, NULL, NULL, 1, 'MFA rollout evidence', 'Initial MFA rollout evidence.',
+    1, 1, 1, NULL, NULL, 1, 'MFA rollout evidence', 'Initial MFA rollout evidence.', 1,
     'NIS2-21-MFA', NULL, 'APPROVED', 1, 'Looks ready for demo.', 1, '2026-04-22T10:00:00Z',
     '2026-04-22T10:00:00Z', '2026-04-22T10:00:00Z'
 ) ON CONFLICT (id) DO NOTHING;