@vorionsys/security 1.0.0

package/dist/compliance/fedramp/incident-reporting.d.ts

@@ -0,0 +1,1001 @@
+/**
+ * FedRAMP Incident Reporting
+ *
+ * Implements FedRAMP incident reporting requirements including:
+ * - US-CERT notification requirements
+ * - Incident categorization (CAT 1-6)
+ * - Reporting timelines
+ * - Evidence preservation
+ *
+ * Based on FedRAMP Incident Communications Procedure and US-CERT Federal Incident
+ * Notification Guidelines.
+ *
+ * @packageDocumentation
+ */
+import { z } from 'zod';
+/**
+ * US-CERT Incident Categories (CAT 1-6)
+ *
+ * CAT 1: Unauthorized Access - Highest priority
+ * CAT 2: Denial of Service
+ * CAT 3: Malicious Code
+ * CAT 4: Improper Usage
+ * CAT 5: Scans/Probes/Attempted Access
+ * CAT 6: Investigation (unconfirmed incidents)
+ */
+export declare const INCIDENT_CATEGORIES: readonly ["CAT-1", "CAT-2", "CAT-3", "CAT-4", "CAT-5", "CAT-6"];
+export type IncidentCategory = (typeof INCIDENT_CATEGORIES)[number];
+/**
+ * Incident category definitions
+ */
+export declare const INCIDENT_CATEGORY_DEFINITIONS: Record<IncidentCategory, {
+    name: string;
+    description: string;
+    reportingTimeframe: string;
+    reportingTimeframeHours: number;
+    examples: string[];
+}>;
+/**
+ * Incident status
+ */
+export declare const INCIDENT_STATUSES: readonly ["detected", "reported", "investigating", "contained", "eradicated", "recovering", "closed", "post-incident-review"];
+export type IncidentStatus = (typeof INCIDENT_STATUSES)[number];
+/**
+ * Notification recipients
+ */
+export declare const NOTIFICATION_RECIPIENTS: readonly ["us-cert", "fedramp-pmo", "agency-isso", "agency-ciso", "authorizing-official", "internal-security", "legal", "executive", "affected-customers"];
+export type NotificationRecipient = (typeof NOTIFICATION_RECIPIENTS)[number];
+/**
+ * Evidence type
+ */
+export declare const EVIDENCE_TYPES: readonly ["log-file", "memory-dump", "disk-image", "network-capture", "screenshot", "configuration", "malware-sample", "indicator-of-compromise", "forensic-report", "timeline", "interview-notes", "other"];
+export type EvidenceType = (typeof EVIDENCE_TYPES)[number];
+/**
+ * Preserved evidence record
+ */
+export interface PreservedEvidence {
+    /** Unique identifier */
+    id: string;
+    /** Evidence type */
+    type: EvidenceType;
+    /** Title/name */
+    title: string;
+    /** Description */
+    description: string;
+    /** Collection timestamp */
+    collectedAt: Date;
+    /** Collected by */
+    collectedBy: string;
+    /** Chain of custody started */
+    chainOfCustodyStarted: Date;
+    /** Current custodian */
+    currentCustodian: string;
+    /** Storage location */
+    storageLocation: string;
+    /** Hash of evidence (for integrity) */
+    hash: string;
+    /** Hash algorithm used */
+    hashAlgorithm: 'sha256' | 'sha384' | 'sha512';
+    /** Is evidence encrypted */
+    isEncrypted: boolean;
+    /** File size in bytes */
+    fileSizeBytes?: number;
+    /** Source system */
+    sourceSystem: string;
+    /** Retention required until */
+    retentionUntil: Date;
+    /** Chain of custody log */
+    chainOfCustodyLog: Array<{
+        timestamp: Date;
+        action: 'collected' | 'transferred' | 'accessed' | 'copied' | 'stored';
+        fromPerson?: string;
+        toPerson: string;
+        reason: string;
+        signature?: string;
+    }>;
+}
+export declare const preservedEvidenceSchema: z.ZodObject<{
+    id: z.ZodString;
+    type: z.ZodEnum<["log-file", "memory-dump", "disk-image", "network-capture", "screenshot", "configuration", "malware-sample", "indicator-of-compromise", "forensic-report", "timeline", "interview-notes", "other"]>;
+    title: z.ZodString;
+    description: z.ZodString;
+    collectedAt: z.ZodDate;
+    collectedBy: z.ZodString;
+    chainOfCustodyStarted: z.ZodDate;
+    currentCustodian: z.ZodString;
+    storageLocation: z.ZodString;
+    hash: z.ZodString;
+    hashAlgorithm: z.ZodEnum<["sha256", "sha384", "sha512"]>;
+    isEncrypted: z.ZodBoolean;
+    fileSizeBytes: z.ZodOptional<z.ZodNumber>;
+    sourceSystem: z.ZodString;
+    retentionUntil: z.ZodDate;
+    chainOfCustodyLog: z.ZodArray<z.ZodObject<{
+        timestamp: z.ZodDate;
+        action: z.ZodEnum<["collected", "transferred", "accessed", "copied", "stored"]>;
+        fromPerson: z.ZodOptional<z.ZodString>;
+        toPerson: z.ZodString;
+        reason: z.ZodString;
+        signature: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        timestamp?: Date;
+        reason?: string;
+        action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+        signature?: string;
+        fromPerson?: string;
+        toPerson?: string;
+    }, {
+        timestamp?: Date;
+        reason?: string;
+        action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+        signature?: string;
+        fromPerson?: string;
+        toPerson?: string;
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
+    title?: string;
+    description?: string;
+    hash?: string;
+    retentionUntil?: Date;
+    collectedAt?: Date;
+    collectedBy?: string;
+    hashAlgorithm?: "sha256" | "sha384" | "sha512";
+    isEncrypted?: boolean;
+    chainOfCustodyStarted?: Date;
+    currentCustodian?: string;
+    storageLocation?: string;
+    fileSizeBytes?: number;
+    sourceSystem?: string;
+    chainOfCustodyLog?: {
+        timestamp?: Date;
+        reason?: string;
+        action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+        signature?: string;
+        fromPerson?: string;
+        toPerson?: string;
+    }[];
+}, {
+    id?: string;
+    type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
+    title?: string;
+    description?: string;
+    hash?: string;
+    retentionUntil?: Date;
+    collectedAt?: Date;
+    collectedBy?: string;
+    hashAlgorithm?: "sha256" | "sha384" | "sha512";
+    isEncrypted?: boolean;
+    chainOfCustodyStarted?: Date;
+    currentCustodian?: string;
+    storageLocation?: string;
+    fileSizeBytes?: number;
+    sourceSystem?: string;
+    chainOfCustodyLog?: {
+        timestamp?: Date;
+        reason?: string;
+        action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+        signature?: string;
+        fromPerson?: string;
+        toPerson?: string;
+    }[];
+}>;
+/**
+ * Notification record
+ */
+export interface IncidentNotification {
+    /** Unique identifier */
+    id: string;
+    /** Recipient type */
+    recipient: NotificationRecipient;
+    /** Recipient name */
+    recipientName: string;
+    /** Recipient email/contact */
+    recipientContact: string;
+    /** Notification method */
+    method: 'email' | 'phone' | 'portal' | 'secure-message';
+    /** Notification time */
+    sentAt: Date;
+    /** Sent by */
+    sentBy: string;
+    /** Content summary */
+    contentSummary: string;
+    /** Acknowledgment received */
+    acknowledgmentReceived?: boolean;
+    /** Acknowledgment time */
+    acknowledgmentTime?: Date;
+    /** Tracking number (e.g., US-CERT ticket) */
+    trackingNumber?: string;
+    /** Follow-up required */
+    followUpRequired: boolean;
+    /** Follow-up date */
+    followUpDate?: Date;
+}
+export declare const incidentNotificationSchema: z.ZodObject<{
+    id: z.ZodString;
+    recipient: z.ZodEnum<["us-cert", "fedramp-pmo", "agency-isso", "agency-ciso", "authorizing-official", "internal-security", "legal", "executive", "affected-customers"]>;
+    recipientName: z.ZodString;
+    recipientContact: z.ZodString;
+    method: z.ZodEnum<["email", "phone", "portal", "secure-message"]>;
+    sentAt: z.ZodDate;
+    sentBy: z.ZodString;
+    contentSummary: z.ZodString;
+    acknowledgmentReceived: z.ZodOptional<z.ZodBoolean>;
+    acknowledgmentTime: z.ZodOptional<z.ZodDate>;
+    trackingNumber: z.ZodOptional<z.ZodString>;
+    followUpRequired: z.ZodBoolean;
+    followUpDate: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    method?: "email" | "phone" | "portal" | "secure-message";
+    sentAt?: Date;
+    recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
+    recipientName?: string;
+    recipientContact?: string;
+    sentBy?: string;
+    contentSummary?: string;
+    acknowledgmentReceived?: boolean;
+    acknowledgmentTime?: Date;
+    trackingNumber?: string;
+    followUpRequired?: boolean;
+    followUpDate?: Date;
+}, {
+    id?: string;
+    method?: "email" | "phone" | "portal" | "secure-message";
+    sentAt?: Date;
+    recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
+    recipientName?: string;
+    recipientContact?: string;
+    sentBy?: string;
+    contentSummary?: string;
+    acknowledgmentReceived?: boolean;
+    acknowledgmentTime?: Date;
+    trackingNumber?: string;
+    followUpRequired?: boolean;
+    followUpDate?: Date;
+}>;
+/**
+ * Security incident record
+ */
+export interface SecurityIncident {
+    /** Unique identifier */
+    id: string;
+    /** Incident title */
+    title: string;
+    /** Detailed description */
+    description: string;
+    /** Incident category */
+    category: IncidentCategory;
+    /** Current status */
+    status: IncidentStatus;
+    /** Detection timestamp */
+    detectedAt: Date;
+    /** Detection method */
+    detectionMethod: string;
+    /** Detected by */
+    detectedBy: string;
+    /** Incident commander/handler */
+    incidentHandler: string;
+    /** Affected systems */
+    affectedSystems: string[];
+    /** Affected data types */
+    affectedDataTypes: string[];
+    /** Estimated affected users/records */
+    estimatedImpact?: {
+        usersAffected?: number;
+        recordsAffected?: number;
+        systemsAffected: number;
+    };
+    /** Is PII involved */
+    piiInvolved: boolean;
+    /** Is PHI involved */
+    phiInvolved: boolean;
+    /** Root cause (when known) */
+    rootCause?: string;
+    /** Attack vector (when known) */
+    attackVector?: string;
+    /** Indicators of compromise */
+    iocs: Array<{
+        type: 'ip' | 'domain' | 'hash' | 'email' | 'url' | 'other';
+        value: string;
+        description?: string;
+    }>;
+    /** Timeline of events */
+    timeline: Array<{
+        timestamp: Date;
+        event: string;
+        actor?: string;
+    }>;
+    /** Notifications sent */
+    notifications: IncidentNotification[];
+    /** Preserved evidence */
+    evidence: PreservedEvidence[];
+    /** Containment actions taken */
+    containmentActions: Array<{
+        timestamp: Date;
+        action: string;
+        performedBy: string;
+        result: string;
+    }>;
+    /** Eradication actions taken */
+    eradicationActions: Array<{
+        timestamp: Date;
+        action: string;
+        performedBy: string;
+        result: string;
+    }>;
+    /** Recovery actions taken */
+    recoveryActions: Array<{
+        timestamp: Date;
+        action: string;
+        performedBy: string;
+        result: string;
+    }>;
+    /** Lessons learned (post-incident) */
+    lessonsLearned?: string;
+    /** Recommendations */
+    recommendations?: string[];
+    /** Related POA&M IDs */
+    relatedPOAMIds?: string[];
+    /** Closure date */
+    closedAt?: Date;
+    /** Closure notes */
+    closureNotes?: string;
+    /** Reporting deadline */
+    reportingDeadline: Date;
+    /** Is reported to US-CERT */
+    reportedToUSCERT: boolean;
+    /** US-CERT ticket number */
+    usCertTicketNumber?: string;
+    /** Is reported to FedRAMP */
+    reportedToFedRAMP: boolean;
+    /** FedRAMP notification date */
+    fedrampNotificationDate?: Date;
+}
+export declare const securityIncidentSchema: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    description: z.ZodString;
+    category: z.ZodEnum<["CAT-1", "CAT-2", "CAT-3", "CAT-4", "CAT-5", "CAT-6"]>;
+    status: z.ZodEnum<["detected", "reported", "investigating", "contained", "eradicated", "recovering", "closed", "post-incident-review"]>;
+    detectedAt: z.ZodDate;
+    detectionMethod: z.ZodString;
+    detectedBy: z.ZodString;
+    incidentHandler: z.ZodString;
+    affectedSystems: z.ZodArray<z.ZodString, "many">;
+    affectedDataTypes: z.ZodArray<z.ZodString, "many">;
+    estimatedImpact: z.ZodOptional<z.ZodObject<{
+        usersAffected: z.ZodOptional<z.ZodNumber>;
+        recordsAffected: z.ZodOptional<z.ZodNumber>;
+        systemsAffected: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        recordsAffected?: number;
+        usersAffected?: number;
+        systemsAffected?: number;
+    }, {
+        recordsAffected?: number;
+        usersAffected?: number;
+        systemsAffected?: number;
+    }>>;
+    piiInvolved: z.ZodBoolean;
+    phiInvolved: z.ZodBoolean;
+    rootCause: z.ZodOptional<z.ZodString>;
+    attackVector: z.ZodOptional<z.ZodString>;
+    iocs: z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["ip", "domain", "hash", "email", "url", "other"]>;
+        value: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        value?: string;
+        type?: "url" | "email" | "domain" | "ip" | "other" | "hash";
+        description?: string;
+    }, {
+        value?: string;
+        type?: "url" | "email" | "domain" | "ip" | "other" | "hash";
+        description?: string;
+    }>, "many">;
+    timeline: z.ZodArray<z.ZodObject<{
+        timestamp: z.ZodDate;
+        event: z.ZodString;
+        actor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        timestamp?: Date;
+        event?: string;
+        actor?: string;
+    }, {
+        timestamp?: Date;
+        event?: string;
+        actor?: string;
+    }>, "many">;
+    notifications: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        recipient: z.ZodEnum<["us-cert", "fedramp-pmo", "agency-isso", "agency-ciso", "authorizing-official", "internal-security", "legal", "executive", "affected-customers"]>;
+        recipientName: z.ZodString;
+        recipientContact: z.ZodString;
+        method: z.ZodEnum<["email", "phone", "portal", "secure-message"]>;
+        sentAt: z.ZodDate;
+        sentBy: z.ZodString;
+        contentSummary: z.ZodString;
+        acknowledgmentReceived: z.ZodOptional<z.ZodBoolean>;
+        acknowledgmentTime: z.ZodOptional<z.ZodDate>;
+        trackingNumber: z.ZodOptional<z.ZodString>;
+        followUpRequired: z.ZodBoolean;
+        followUpDate: z.ZodOptional<z.ZodDate>;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        method?: "email" | "phone" | "portal" | "secure-message";
+        sentAt?: Date;
+        recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
+        recipientName?: string;
+        recipientContact?: string;
+        sentBy?: string;
+        contentSummary?: string;
+        acknowledgmentReceived?: boolean;
+        acknowledgmentTime?: Date;
+        trackingNumber?: string;
+        followUpRequired?: boolean;
+        followUpDate?: Date;
+    }, {
+        id?: string;
+        method?: "email" | "phone" | "portal" | "secure-message";
+        sentAt?: Date;
+        recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
+        recipientName?: string;
+        recipientContact?: string;
+        sentBy?: string;
+        contentSummary?: string;
+        acknowledgmentReceived?: boolean;
+        acknowledgmentTime?: Date;
+        trackingNumber?: string;
+        followUpRequired?: boolean;
+        followUpDate?: Date;
+    }>, "many">;
+    evidence: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        type: z.ZodEnum<["log-file", "memory-dump", "disk-image", "network-capture", "screenshot", "configuration", "malware-sample", "indicator-of-compromise", "forensic-report", "timeline", "interview-notes", "other"]>;
+        title: z.ZodString;
+        description: z.ZodString;
+        collectedAt: z.ZodDate;
+        collectedBy: z.ZodString;
+        chainOfCustodyStarted: z.ZodDate;
+        currentCustodian: z.ZodString;
+        storageLocation: z.ZodString;
+        hash: z.ZodString;
+        hashAlgorithm: z.ZodEnum<["sha256", "sha384", "sha512"]>;
+        isEncrypted: z.ZodBoolean;
+        fileSizeBytes: z.ZodOptional<z.ZodNumber>;
+        sourceSystem: z.ZodString;
+        retentionUntil: z.ZodDate;
+        chainOfCustodyLog: z.ZodArray<z.ZodObject<{
+            timestamp: z.ZodDate;
+            action: z.ZodEnum<["collected", "transferred", "accessed", "copied", "stored"]>;
+            fromPerson: z.ZodOptional<z.ZodString>;
+            toPerson: z.ZodString;
+            reason: z.ZodString;
+            signature: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            timestamp?: Date;
+            reason?: string;
+            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+            signature?: string;
+            fromPerson?: string;
+            toPerson?: string;
+        }, {
+            timestamp?: Date;
+            reason?: string;
+            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+            signature?: string;
+            fromPerson?: string;
+            toPerson?: string;
+        }>, "many">;
+    }, "strip", z.ZodTypeAny, {
+        id?: string;
+        type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
+        title?: string;
+        description?: string;
+        hash?: string;
+        retentionUntil?: Date;
+        collectedAt?: Date;
+        collectedBy?: string;
+        hashAlgorithm?: "sha256" | "sha384" | "sha512";
+        isEncrypted?: boolean;
+        chainOfCustodyStarted?: Date;
+        currentCustodian?: string;
+        storageLocation?: string;
+        fileSizeBytes?: number;
+        sourceSystem?: string;
+        chainOfCustodyLog?: {
+            timestamp?: Date;
+            reason?: string;
+            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+            signature?: string;
+            fromPerson?: string;
+            toPerson?: string;
+        }[];
+    }, {
+        id?: string;
+        type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
+        title?: string;
+        description?: string;
+        hash?: string;
+        retentionUntil?: Date;
+        collectedAt?: Date;
+        collectedBy?: string;
+        hashAlgorithm?: "sha256" | "sha384" | "sha512";
+        isEncrypted?: boolean;
+        chainOfCustodyStarted?: Date;
+        currentCustodian?: string;
+        storageLocation?: string;
+        fileSizeBytes?: number;
+        sourceSystem?: string;
+        chainOfCustodyLog?: {
+            timestamp?: Date;
+            reason?: string;
+            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+            signature?: string;
+            fromPerson?: string;
+            toPerson?: string;
+        }[];
+    }>, "many">;
+    containmentActions: z.ZodArray<z.ZodObject<{
+        timestamp: z.ZodDate;
+        action: z.ZodString;
+        performedBy: z.ZodString;
+        result: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }, {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }>, "many">;
+    eradicationActions: z.ZodArray<z.ZodObject<{
+        timestamp: z.ZodDate;
+        action: z.ZodString;
+        performedBy: z.ZodString;
+        result: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }, {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }>, "many">;
+    recoveryActions: z.ZodArray<z.ZodObject<{
+        timestamp: z.ZodDate;
+        action: z.ZodString;
+        performedBy: z.ZodString;
+        result: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }, {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }>, "many">;
+    lessonsLearned: z.ZodOptional<z.ZodString>;
+    recommendations: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    relatedPOAMIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    closedAt: z.ZodOptional<z.ZodDate>;
+    closureNotes: z.ZodOptional<z.ZodString>;
+    reportingDeadline: z.ZodDate;
+    reportedToUSCERT: z.ZodBoolean;
+    usCertTicketNumber: z.ZodOptional<z.ZodString>;
+    reportedToFedRAMP: z.ZodBoolean;
+    fedrampNotificationDate: z.ZodOptional<z.ZodDate>;
+}, "strip", z.ZodTypeAny, {
+    id?: string;
+    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "reported" | "recovering" | "post-incident-review";
+    title?: string;
+    description?: string;
+    category?: "CAT-1" | "CAT-2" | "CAT-3" | "CAT-4" | "CAT-5" | "CAT-6";
+    timeline?: {
+        timestamp?: Date;
+        event?: string;
+        actor?: string;
+    }[];
+    recommendations?: string[];
+    notifications?: {
+        id?: string;
+        method?: "email" | "phone" | "portal" | "secure-message";
+        sentAt?: Date;
+        recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
+        recipientName?: string;
+        recipientContact?: string;
+        sentBy?: string;
+        contentSummary?: string;
+        acknowledgmentReceived?: boolean;
+        acknowledgmentTime?: Date;
+        trackingNumber?: string;
+        followUpRequired?: boolean;
+        followUpDate?: Date;
+    }[];
+    detectedAt?: Date;
+    closedAt?: Date;
+    evidence?: {
+        id?: string;
+        type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
+        title?: string;
+        description?: string;
+        hash?: string;
+        retentionUntil?: Date;
+        collectedAt?: Date;
+        collectedBy?: string;
+        hashAlgorithm?: "sha256" | "sha384" | "sha512";
+        isEncrypted?: boolean;
+        chainOfCustodyStarted?: Date;
+        currentCustodian?: string;
+        storageLocation?: string;
+        fileSizeBytes?: number;
+        sourceSystem?: string;
+        chainOfCustodyLog?: {
+            timestamp?: Date;
+            reason?: string;
+            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+            signature?: string;
+            fromPerson?: string;
+            toPerson?: string;
+        }[];
+    }[];
+    rootCause?: string;
+    lessonsLearned?: string;
+    detectionMethod?: string;
+    detectedBy?: string;
+    incidentHandler?: string;
+    affectedSystems?: string[];
+    affectedDataTypes?: string[];
+    estimatedImpact?: {
+        recordsAffected?: number;
+        usersAffected?: number;
+        systemsAffected?: number;
+    };
+    piiInvolved?: boolean;
+    phiInvolved?: boolean;
+    attackVector?: string;
+    iocs?: {
+        value?: string;
+        type?: "url" | "email" | "domain" | "ip" | "other" | "hash";
+        description?: string;
+    }[];
+    containmentActions?: {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }[];
+    eradicationActions?: {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }[];
+    recoveryActions?: {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }[];
+    relatedPOAMIds?: string[];
+    closureNotes?: string;
+    reportingDeadline?: Date;
+    reportedToUSCERT?: boolean;
+    usCertTicketNumber?: string;
+    reportedToFedRAMP?: boolean;
+    fedrampNotificationDate?: Date;
+}, {
+    id?: string;
+    status?: "closed" | "investigating" | "detected" | "contained" | "eradicated" | "reported" | "recovering" | "post-incident-review";
+    title?: string;
+    description?: string;
+    category?: "CAT-1" | "CAT-2" | "CAT-3" | "CAT-4" | "CAT-5" | "CAT-6";
+    timeline?: {
+        timestamp?: Date;
+        event?: string;
+        actor?: string;
+    }[];
+    recommendations?: string[];
+    notifications?: {
+        id?: string;
+        method?: "email" | "phone" | "portal" | "secure-message";
+        sentAt?: Date;
+        recipient?: "legal" | "executive" | "us-cert" | "fedramp-pmo" | "agency-isso" | "agency-ciso" | "authorizing-official" | "internal-security" | "affected-customers";
+        recipientName?: string;
+        recipientContact?: string;
+        sentBy?: string;
+        contentSummary?: string;
+        acknowledgmentReceived?: boolean;
+        acknowledgmentTime?: Date;
+        trackingNumber?: string;
+        followUpRequired?: boolean;
+        followUpDate?: Date;
+    }[];
+    detectedAt?: Date;
+    closedAt?: Date;
+    evidence?: {
+        id?: string;
+        type?: "other" | "configuration" | "timeline" | "screenshot" | "log-file" | "memory-dump" | "disk-image" | "network-capture" | "malware-sample" | "indicator-of-compromise" | "forensic-report" | "interview-notes";
+        title?: string;
+        description?: string;
+        hash?: string;
+        retentionUntil?: Date;
+        collectedAt?: Date;
+        collectedBy?: string;
+        hashAlgorithm?: "sha256" | "sha384" | "sha512";
+        isEncrypted?: boolean;
+        chainOfCustodyStarted?: Date;
+        currentCustodian?: string;
+        storageLocation?: string;
+        fileSizeBytes?: number;
+        sourceSystem?: string;
+        chainOfCustodyLog?: {
+            timestamp?: Date;
+            reason?: string;
+            action?: "stored" | "collected" | "transferred" | "accessed" | "copied";
+            signature?: string;
+            fromPerson?: string;
+            toPerson?: string;
+        }[];
+    }[];
+    rootCause?: string;
+    lessonsLearned?: string;
+    detectionMethod?: string;
+    detectedBy?: string;
+    incidentHandler?: string;
+    affectedSystems?: string[];
+    affectedDataTypes?: string[];
+    estimatedImpact?: {
+        recordsAffected?: number;
+        usersAffected?: number;
+        systemsAffected?: number;
+    };
+    piiInvolved?: boolean;
+    phiInvolved?: boolean;
+    attackVector?: string;
+    iocs?: {
+        value?: string;
+        type?: "url" | "email" | "domain" | "ip" | "other" | "hash";
+        description?: string;
+    }[];
+    containmentActions?: {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }[];
+    eradicationActions?: {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }[];
+    recoveryActions?: {
+        timestamp?: Date;
+        result?: string;
+        action?: string;
+        performedBy?: string;
+    }[];
+    relatedPOAMIds?: string[];
+    closureNotes?: string;
+    reportingDeadline?: Date;
+    reportedToUSCERT?: boolean;
+    usCertTicketNumber?: string;
+    reportedToFedRAMP?: boolean;
+    fedrampNotificationDate?: Date;
+}>;
+/**
+ * Incident reporting configuration
+ */
+export interface IncidentReportingConfig {
+    /** Organization name */
+    organizationName: string;
+    /** System name */
+    systemName: string;
+    /** FedRAMP package ID */
+    fedrampPackageId: string;
+    /** ISSO contact */
+    isso: {
+        name: string;
+        email: string;
+        phone: string;
+    };
+    /** CISO contact */
+    ciso: {
+        name: string;
+        email: string;
+        phone: string;
+    };
+    /** US-CERT POC */
+    usCertPoc: {
+        name: string;
+        email: string;
+        phone: string;
+    };
+    /** FedRAMP PMO contact */
+    fedrampPmoPoc: {
+        name: string;
+        email: string;
+    };
+    /** Agency ISSO contact */
+    agencyIsso?: {
+        name: string;
+        email: string;
+        phone: string;
+    };
+    /** Evidence retention period (days) */
+    evidenceRetentionDays: number;
+    /** Auto-escalation enabled */
+    autoEscalation: boolean;
+}
+/**
+ * FedRAMP Incident Reporting Service
+ */
+export declare class IncidentReportingService {
+    private config;
+    private incidents;
+    constructor(config: IncidentReportingConfig);
+    /**
+     * Create a new incident
+     */
+    createIncident(incident: Omit<SecurityIncident, 'id' | 'notifications' | 'evidence' | 'containmentActions' | 'eradicationActions' | 'recoveryActions' | 'reportingDeadline' | 'reportedToUSCERT' | 'reportedToFedRAMP'>): SecurityIncident;
+    /**
+     * Check and alert on notification requirements
+     */
+    private checkNotificationRequirements;
+    /**
+     * Update incident status
+     */
+    updateStatus(incidentId: string, status: IncidentStatus, notes?: string): SecurityIncident;
+    /**
+     * Add containment action
+     */
+    addContainmentAction(incidentId: string, action: string, performedBy: string, result: string): SecurityIncident;
+    /**
+     * Add eradication action
+     */
+    addEradicationAction(incidentId: string, action: string, performedBy: string, result: string): SecurityIncident;
+    /**
+     * Add recovery action
+     */
+    addRecoveryAction(incidentId: string, action: string, performedBy: string, result: string): SecurityIncident;
+    /**
+     * Add IOC to incident
+     */
+    addIOC(incidentId: string, type: 'ip' | 'domain' | 'hash' | 'email' | 'url' | 'other', value: string, description?: string): SecurityIncident;
+    /**
+     * Record a notification sent
+     */
+    recordNotification(incidentId: string, notification: Omit<IncidentNotification, 'id'>): IncidentNotification;
+    /**
+     * Record notification acknowledgment
+     */
+    recordAcknowledgment(incidentId: string, notificationId: string, trackingNumber?: string): void;
+    /**
+     * Get required notifications for incident
+     */
+    getRequiredNotifications(incidentId: string): NotificationRecipient[];
+    /**
+     * Get missing required notifications
+     */
+    getMissingNotifications(incidentId: string): NotificationRecipient[];
+    /**
+     * Preserve evidence
+     */
+    preserveEvidence(incidentId: string, evidence: Omit<PreservedEvidence, 'id' | 'chainOfCustodyLog'>): PreservedEvidence;
+    /**
+     * Transfer evidence custody
+     */
+    transferEvidence(incidentId: string, evidenceId: string, toPerson: string, reason: string): void;
+    /**
+     * Record evidence access
+     */
+    recordEvidenceAccess(incidentId: string, evidenceId: string, accessedBy: string, reason: string): void;
+    /**
+     * Get incident by ID
+     */
+    getIncident(id: string): SecurityIncident | undefined;
+    /**
+     * Get all incidents
+     */
+    getAllIncidents(filter?: {
+        category?: IncidentCategory;
+        status?: IncidentStatus;
+        startDate?: Date;
+        endDate?: Date;
+        piiInvolved?: boolean;
+    }): SecurityIncident[];
+    /**
+     * Get open incidents
+     */
+    getOpenIncidents(): SecurityIncident[];
+    /**
+     * Get incidents past reporting deadline
+     */
+    getOverdueReporting(): SecurityIncident[];
+    /**
+     * Get incidents requiring follow-up
+     */
+    getFollowUpRequired(): SecurityIncident[];
+    /**
+     * Generate incident summary for FedRAMP monthly report
+     */
+    generateMonthlyReport(month: Date): IncidentMonthlyReport;
+    /**
+     * Generate US-CERT incident report format
+     */
+    generateUSCERTReport(incidentId: string): USCERTIncidentReport;
+}
+export interface IncidentMonthlyReport {
+    reportPeriod: {
+        start: Date;
+        end: Date;
+    };
+    systemName: string;
+    generatedAt: Date;
+    totalIncidents: number;
+    byCategory: Record<IncidentCategory, number>;
+    openIncidents: number;
+    closedIncidents: number;
+    piiIncidents: number;
+    averageResolutionTimeHours: number;
+    overdueReporting: number;
+    incidentSummaries: Array<{
+        id: string;
+        title: string;
+        category: IncidentCategory;
+        status: IncidentStatus;
+        detectedAt: Date;
+        reportedToUSCERT: boolean;
+        usCertTicketNumber?: string;
+        piiInvolved: boolean;
+    }>;
+}
+export interface USCERTIncidentReport {
+    reportDate: Date;
+    incidentCategory: IncidentCategory;
+    incidentCategoryName: string;
+    organizationName: string;
+    systemName: string;
+    fedrampPackageId: string;
+    incidentDescription: string;
+    dateTimeOfIncident: Date;
+    dateTimeDetected: Date;
+    detectionMethod: string;
+    affectedSystems: string[];
+    estimatedImpact?: {
+        usersAffected?: number;
+        recordsAffected?: number;
+        systemsAffected: number;
+    };
+    piiInvolved: boolean;
+    piiDetails: string;
+    phiInvolved: boolean;
+    rootCause: string;
+    attackVector: string;
+    indicatorsOfCompromise: Array<{
+        type: string;
+        value: string;
+        description?: string;
+    }>;
+    containmentActions: string[];
+    eradicationActions: string[];
+    recoveryActions: string[];
+    currentStatus: IncidentStatus;
+    pocName: string;
+    pocEmail: string;
+    pocPhone: string;
+}
+export default IncidentReportingService;
+//# sourceMappingURL=incident-reporting.d.ts.map