Incidents Module

Overview

The Incidents module manages the full lifecycle of security incidents in the ThreatOps SOCaaS platform. When alerts are escalated -- either by analysts or by the autonomous SOC engine -- they become incidents that require coordinated investigation, containment, and resolution.

This module tracks MITRE ATT&CK tactics and techniques, affected assets, indicators of compromise (IOCs), assigned analysts, and resolution timelines. It supports the NIST incident response lifecycle: detection, investigation, containment, eradication, resolution, and closure.

What Was Proposed

• Full incident lifecycle management (new, investigating, containment, eradication, resolved, closed)
• MITRE ATT&CK tactic and technique tagging
• Multi-SIEM source tracking
• Analyst assignment and workload distribution
• IOC and affected asset recording
• Incident statistics (total, open, critical counts)
• List view with filtering + detail view per incident
• Response action buttons (contain, escalate, resolve)

What's Built

Architecture

API Router

File: app/routers/incidents.py — Prefix: /api/v1/incidents

GET    /api/v1/incidents/                 # List incidents (filters: severity, status, mitre_tactic, source_siem)
POST   /api/v1/incidents/                 # Create a new incident
GET    /api/v1/incidents/stats            # Statistics (total, open, critical counts)
GET    /api/v1/incidents/{incident_id}    # Get incident detail
PATCH  /api/v1/incidents/{incident_id}    # Update incident (auto-sets resolved_at/closed_at on status change)

How It Connects

The incidents router is a standard FastAPI CRUD router scoped by request.state.tenant_id. Every query filters by tenant. When an alert is escalated (via the alerts bulk action), it can be linked to an incident via the Alert.incident_id foreign key.

The PATCH endpoint intelligently handles lifecycle transitions: setting resolved_at when status becomes "resolved" and closed_at when status becomes "closed", but only if those timestamps are not already set.

When the database is unavailable, the router returns 8 realistic demo incidents covering ransomware, data exfiltration, BEC, supply chain, insider threat, C2, credential theft, and zero-day scenarios.

Frontend Pages

List View (src/app/incidents/page.tsx): Fetches from GET /api/v1/incidents/. Shows a filterable table with severity, status, and MITRE tactic dropdowns. Each incident title links to the detail page.

Detail View (src/app/incidents/[id]/page.tsx): Fetches from GET /api/v1/incidents/{id}. Shows a 2/3 + 1/3 column layout with incident details, response actions, MITRE ATT&CK info, and IOCs.

Routing

Prerequisites

• Database — PostgreSQL with async SQLAlchemy, incidents table
• Tenant Middleware — Multi-tenant scoping via request.state.tenant_id
• Users Table — For assigned_to foreign key reference
• Alerts Module — Alerts link to incidents via incident_id FK

Data Model

Model: app/models/incident.py — Table: incidents (extends TenantScopedBase)

UI Layout