Incident Management

The page renders two tabs, each backed by a different data model:

• Alerts (Ingest & Triage) — a list of ingested Alert records loaded from /api/alerts. This tab handles raw alert intake, filtering, analytics, and per-alert AI triage details.
• Incident Tickets — a list of IncidentCase workflow tickets loaded from /api/incidents-mgmt. Each ticket has a number, title, category, assignee, severity, and lifecycle status.

Every endpoint requires an authenticated session and is scoped to the caller's organization (multi-tenant). Records with no organization are treated as visible for backward compatibility.

Incident lifecycle statuses

Incident tickets move through a six-stage workflow. When a ticket is set to closed, the server also stamps a closedAt timestamp.

Alert triage statuses

Alerts (distinct from tickets) carry their own status: new, triaged, investigating (shown as ACTIVE), and resolved. Severity values used across both models are Critical, High, Medium, Low (alerts may also be Info).

Ingesting an alert

On the Alerts tab, click + Ingest Alert, paste raw alert text, JSON, or log lines, and submit. The text is posted to /api/alerts with a source of manual, normalized into an Alert record, and the list refreshes.

On ingest the server also fires SOAR playbook matching, and for alerts normalized to Critical or High severity it automatically runs AI triage in the background.

Filtering & analytics

• Search matches against raw alert log text (debounced, case-insensitive).
• Status, Severity, and Source dropdowns filter the list; the source list is derived from the alerts currently loaded.
• Show Analytics reveals grouped counts of alerts by severity, by status, and by source, computed by the API's groupBy aggregations.

Opening an alert & AI triage

Clicking a row opens the Alert Analysis & AI Triage modal, which loads full detail from /api/alerts/{id} (the alert plus any related alerts). The modal shows the source, ingest time, severity, and a status dropdown that writes back via PATCH /api/alerts/{id}.

The raw log is rendered with clickable indicators (IPs, hashes, file paths, emails) — clicking one copies it and appends it to the Analyst Notes field as an extracted IOC. When AI triage results are present, the modal displays a confidence score, extracted IOCs, a MITRE ATT&CK mapping (linking out to attack.mitre.org), and a recommended-response action list. Analysts can choose an AI analyst personality profile (Default SOC Analyst, Paranoid Auditor, Concise Responder, or Expert Threat Hunter) before running triage.

Analyst notes are saved into the alert's triageResults.notes via PATCH /api/alerts/{id}.

Creating a ticket from an alert

Each alert row has a Create Ticket → action that pre-fills the Create Incident Ticket form from the alert's data and tags the new ticket with the source alert's ID (alert_ids), preserving the alert↔ticket link.

Creating and managing tickets

On the Incident Tickets tab, click + Create Incident Ticket and provide a title, description, severity, and category. Title and severity are required. Submitting posts to /api/incidents-mgmt and the new ticket appears in the list.

Each ticket row shows its number, title, category, severity, and status. The inline assignee dropdown is populated from your organization's users (via /api/admin/users, which is admin-only — non-admin viewers see an empty list and fall back to free-text). Changing the assignee writes back through PATCH /api/incidents/{id}/status.

The incident timeline (detail page)

Clicking a ticket opens /incidents/{id}, which loads a unified timeline from /api/incidents/{id}/timeline. The timeline merges four event types into one chronological view:

The detail page also surfaces involved entities (hosts, users, source IPs), a MITRE ATT&CK panel, an event breakdown, an alert-correlation graph, and a duration summary. A status dropdown updates the incident lifecycle, and each change is recorded as a timeline entry.

Response actions & AI analysis

• SOAR Action Center — buttons for Isolate Host, Revoke Session, and Block IP record a response-action entry (marked automated) to the incident timeline via PATCH /api/incidents/{id}/status, documenting containment steps taken against the top involved host, user, or IP.
• AI Analyst — posts to /api/ai/analyze to generate an executive summary, attack-chain analysis, MITRE techniques, remediation recommendations, and a risk score. This requires an AI provider configured under Settings → AI Configuration; otherwise it returns a "not configured" result.
• Export Incident Briefing — generates a Markdown briefing (incident metadata, involved entities, MITRE techniques, and a timeline summary) and downloads it client-side.

All endpoints require an authenticated session and are organization-scoped.

Ingest an alert

curl -X POST https://app.guardfoxsecurity.com/api/alerts \
  -H "Content-Type: application/json" \
  -b "session cookie" \
  -d '{"raw": "Failed SSH login burst from 185.234.219.55", "source": "manual"}'

Create an incident ticket

curl -X POST https://app.guardfoxsecurity.com/api/incidents-mgmt \
  -H "Content-Type: application/json" \
  -b "session cookie" \
  -d '{"title": "Credential stuffing - Finance Portal", "severity": "High", "category": "Authentication", "description": "847 failed auth attempts", "alert_ids": [""]}'

Advance an incident's status

curl -X PATCH https://app.guardfoxsecurity.com/api/incidents//status \
  -H "Content-Type: application/json" \
  -b "session cookie" \
  -d '{"status": "contained"}'