How-to

Handle a breach

The breach module tracks the Rule-7 clocks (without-delay / 72h / 6h) and generates a defensible dossier. You can open a breach manually or auto-open from a SIEM alert.

The suite tracks the clocks and generates the Rule-7 intimation dossier. Delivering that dossier to the Board portal and sending email/SMS to affected principals is your wiring — connect the transport from the dossier export or the webhook. Board-portal and email/SMS connectors are on our roadmap.

1. Open the incident

open

curl -X POST $API/v1/breaches -H "authorization: Bearer sk_live_…" \
  -d '{"description":"Unauthorized DB access","isCyberIncident":true,
       "affectedPrincipals":1200,"categories":["email","phone"]}'
# → { "id":"…", "clocks":[{"id":"board-72h","dueAt":…}, …] }

Auto-open from a SIEM alert

siem

curl -X POST $API/v1/breaches/siem -H "authorization: Bearer sk_live_…" \
  -d '{"source":"splunk","alert":{ ... }}'
# clocks run from the detection time in the alert

2. Record & dispatch principal intimation

Post the intimation details. The suite records them against the breach and emits a signed webhook payload — your transport (email/SMS) sends the actual message to principals.

intimation

curl -X POST $API/v1/breaches/<id>/intimation -H "authorization: Bearer sk_live_…" \
  -d '{"consequences":"…","safetyMeasures":"…","contact":"dpo@you.in"}'

3. Satisfy clocks & pull the dossier

dossier

curl -X POST $API/v1/breaches/<id>/satisfy -H "authorization: Bearer sk_live_…" -d '{"clockId":"board-72h"}'
curl $API/v1/breaches/<id>/dossier -H "authorization: Bearer sk_live_…"

API reference →SDKs →