ObjectStackIncident Response
Incident Response protocol schemas
Incident Response Protocol — ISO 27001:2022 (A.5.24–A.5.28)
Defines schemas for information security event management including incident classification, severity grading, response procedures, and notification matrices.
See also: https://www.iso.org/standard/27001
@category Security
Source: packages/spec/src/system/incident-response.zod.ts
TypeScript Usage
import { IncidentSchema, IncidentCategorySchema, IncidentNotificationMatrixSchema, IncidentNotificationRuleSchema, IncidentResponsePhaseSchema, IncidentResponsePolicySchema, IncidentSeveritySchema, IncidentStatusSchema } from '@objectstack/spec/system';
import type { Incident, IncidentCategory, IncidentNotificationMatrix, IncidentNotificationRule, IncidentResponsePhase, IncidentResponsePolicy, IncidentSeverity, IncidentStatus } from '@objectstack/spec/system';
// Validate data
const result = IncidentSchema.parse(data);Incident
Security incident record per ISO 27001:2022 A.5.24–A.5.28
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| id | string | ✅ | Unique incident identifier |
| title | string | ✅ | Incident title |
| description | string | ✅ | Detailed incident description |
| severity | Enum<'critical' | 'high' | 'medium' | 'low'> | ✅ | Incident severity level |
| category | Enum<'data_breach' | 'malware' | 'unauthorized_access' | 'denial_of_service' | 'social_engineering' | 'insider_threat' | 'physical_security' | 'configuration_error' | … +3 more> | ✅ | Incident category |
| status | Enum<'reported' | 'triaged' | 'investigating' | 'containing' | 'eradicating' | 'recovering' | 'resolved' | 'closed'> | ✅ | Current incident status |
| reportedBy | string | ✅ | Reporter user ID or system name |
| reportedAt | number | ✅ | Report timestamp |
| detectedAt | number | optional | Detection timestamp |
| resolvedAt | number | optional | Resolution timestamp |
| affectedSystems | string[] | ✅ | Affected systems |
| affectedDataClassifications | Enum<'pii' | 'phi' | 'pci' | 'financial' | 'confidential' | 'internal' | 'public'>[] | optional | Affected data classifications |
| responsePhases | { phase: Enum<'identification' | 'containment' | 'eradication' | 'recovery' | 'lessons_learned'>; description: string; assignedTo: string; targetHours: number; … }[] | optional | Incident response phases |
| rootCause | string | optional | Root cause analysis |
| correctiveActions | string[] | optional | Corrective actions taken or planned |
| lessonsLearned | string | optional | Lessons learned from the incident |
| relatedChangeRequestIds | string[] | optional | Related change request IDs |
| metadata | Record<string, any> | optional | Custom metadata key-value pairs |
Allowed Values: Incident.category
data_breachmalwareunauthorized_accessdenial_of_servicesocial_engineeringinsider_threatphysical_securityconfiguration_errorvulnerability_exploitpolicy_violationother
Nested Shape: Incident.responsePhases[number]
Incident response phase with timing and assignment
| Property | Type | Required | Description |
|---|---|---|---|
| phase | Enum<'identification' | 'containment' | 'eradication' | 'recovery' | 'lessons_learned'> | ✅ | Response phase name |
| description | string | ✅ | Phase description and objectives |
| assignedTo | string | ✅ | Responsible team or role |
| targetHours | number | ✅ | Target completion time in hours |
| completedAt | number | optional | Actual completion timestamp |
| notes | string | optional | Phase notes and findings |
IncidentCategory
Allowed Values
data_breachmalwareunauthorized_accessdenial_of_servicesocial_engineeringinsider_threatphysical_securityconfiguration_errorvulnerability_exploitpolicy_violationother
IncidentNotificationMatrix
Incident notification matrix with escalation policies
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| rules | { severity: Enum<'critical' | 'high' | 'medium' | 'low'>; channels: Enum<'email' | 'sms' | 'slack' | 'pagerduty' | 'webhook'>[]; recipients: string[]; withinMinutes: number; … }[] | ✅ | Notification rules by severity level |
| escalationTimeoutMinutes | number | optional (default: 30) | Auto-escalation timeout in minutes |
| escalationChain | string[] | optional (default: []) | Ordered escalation chain of roles |
Nested Shape: IncidentNotificationMatrix.rules[number]
Incident notification rule per severity level
| Property | Type | Required | Description |
|---|---|---|---|
| severity | Enum<'critical' | 'high' | 'medium' | 'low'> | ✅ | Minimum severity to trigger notification |
| channels | Enum<'email' | 'sms' | 'slack' | 'pagerduty' | 'webhook'>[] | ✅ | Notification channels |
| recipients | string[] | ✅ | Roles or teams to notify |
| withinMinutes | number | ✅ | Notification deadline in minutes from detection |
| notifyRegulators | boolean | optional (default: false) | Whether to notify regulatory authorities |
| regulatorDeadlineHours | number | optional | Regulatory notification deadline in hours |
IncidentNotificationRule
Incident notification rule per severity level
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| severity | Enum<'critical' | 'high' | 'medium' | 'low'> | ✅ | Minimum severity to trigger notification |
| channels | Enum<'email' | 'sms' | 'slack' | 'pagerduty' | 'webhook'>[] | ✅ | Notification channels |
| recipients | string[] | ✅ | Roles or teams to notify |
| withinMinutes | number | ✅ | Notification deadline in minutes from detection |
| notifyRegulators | boolean | optional (default: false) | Whether to notify regulatory authorities |
| regulatorDeadlineHours | number | optional | Regulatory notification deadline in hours |
IncidentResponsePhase
Incident response phase with timing and assignment
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| phase | Enum<'identification' | 'containment' | 'eradication' | 'recovery' | 'lessons_learned'> | ✅ | Response phase name |
| description | string | ✅ | Phase description and objectives |
| assignedTo | string | ✅ | Responsible team or role |
| targetHours | number | ✅ | Target completion time in hours |
| completedAt | number | optional | Actual completion timestamp |
| notes | string | optional | Phase notes and findings |
IncidentResponsePolicy
Organization-level incident response policy per ISO 27001:2022
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| enabled | boolean | optional (default: true) | Enable incident response management |
| notificationMatrix | { rules: object[]; escalationTimeoutMinutes: number; escalationChain: string[] } | ✅ | Notification and escalation matrix |
| defaultResponseTeam | string | ✅ | Default incident response team or role |
| triageDeadlineHours | number | optional (default: 1) | Maximum hours to begin triage after detection |
| requirePostIncidentReview | boolean | optional (default: true) | Require post-incident review for all incidents |
| regulatoryNotificationThreshold | Enum<'critical' | 'high' | 'medium' | 'low'> | optional (default: "high") | Minimum severity requiring regulatory notification |
| retentionDays | number | optional (default: 2555) | Incident record retention period in days (default ~7 years) |
Nested Shape: IncidentResponsePolicy.notificationMatrix
| Property | Type | Required | Description |
|---|---|---|---|
| rules | { severity: Enum<'critical' | 'high' | 'medium' | 'low'>; channels: Enum<'email' | 'sms' | 'slack' | 'pagerduty' | 'webhook'>[]; recipients: string[]; withinMinutes: number; … }[] | ✅ | Notification rules by severity level |
| escalationTimeoutMinutes | number | optional (default: 30) | Auto-escalation timeout in minutes |
| escalationChain | string[] | optional (default: []) | Ordered escalation chain of roles |
IncidentSeverity
Allowed Values
criticalhighmediumlow
IncidentStatus
Allowed Values
reportedtriagedinvestigatingcontainingeradicatingrecoveringresolvedclosed