rterm-backend 2.7.3 → 2.7.4

package/bin/gybackend.js

@@ -377295,6 +377295,9 @@ function createTriggerRuntime(deps) {
   return Object.assign(engine, { busReady });
 }
 
+// ../../packages/backend/src/services/observability.ts
+import { createRequire as createRequire2 } from "node:module";
+
 // ../../packages/backend/src/services/sre/metricsLedger.ts
 var DEFAULT_LIMIT = 1e4;
 function flattenSnapshot(host, snap) {
@@ -382285,8 +382288,16 @@ function createObservability(deps) {
   const auditLedger = new AuditLedger({});
   const evidenceSealer = new EvidenceSealer({});
   const pluginScanRoot = (process.env.GYBACKEND_DATA_DIR ?? "./.gybackend-data") + "/plugins";
+  const bundlePluginRoot = new URL("../../plugins/", import.meta.url).pathname;
+  const scanRoots = [pluginScanRoot, "./plugins"];
+  try {
+    const req = createRequire2(import.meta.url);
+    const fs22 = req("node:fs");
+    if (fs22.existsSync(bundlePluginRoot)) scanRoots.push(bundlePluginRoot);
+  } catch {
+  }
   const pluginRegistry = new PluginRegistry({
-    scanRoots: [pluginScanRoot, "./plugins"],
+    scanRoots,
     createContext: (record2) => PluginRegistry.defaultContext(
       record2,
       async (cmd, opts) => deps.agentService ? `exec(${cmd} on ${opts?.host ?? "local"})` : "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rterm-backend",
-  "version": "2.7.3",
+  "version": "2.7.4",
   "description": "RTerm headless backend — run RTerm-as-a-service (AI agent, SSH/WinRM/Serial/local terminals, fleet orchestration, advanced automation with event-driven triggers + NATS event mesh, scheduled automation, SRE observability, Netdata integration, AWS APerf performance deep-dive, plugin system) and drive it over a WebSocket JSON-RPC gateway. No desktop UI required.",
   "license": "Apache-2.0",
   "type": "module",
@@ -10,6 +10,7 @@
   "main": "bin/gybackend.js",
   "files": [
     "bin/",
+    "plugins/",
     "README.md",
     "LICENSE.md"
   ],

package/plugins/fraudops/index.d.mts

@@ -0,0 +1,9 @@
+// fraudops plugin type declarations
+export function register(ctx: any): void
+export function buildPipelineHealthCommand(): string
+export function buildNatsStatusCommand(): string
+export function buildKafkaLagCommand(): string
+export function parsePipelineHealth(output: string): { status: string; jobs: any[]; running: number; failed: number }
+export function buildStrCase(txnId: string, decision: string, indicators?: string[], assignedTo?: string): any
+export function buildDecisionSummary(decisions: Array<{ decision: string }>): { total: number; blocks: number; reviews: number; approves: number; blockRate: number; reviewRate: number; approveRate: number }
+export default any

package/plugins/fraudops/index.mjs

@@ -0,0 +1,184 @@
+/**
+ * fraudops plugin — FraudOps for RTerm.
+ *
+ * Operational layer for the fraud detection pipeline. Monitors pipeline health
+ * (Flink, NATS, Kafka), manages STR workflow, tracks fraud incidents, and
+ * provides the unified fraud operations dashboard. Bridges Kafka/NATS metrics
+ * into RTerm's SRE pillar.
+ */
+
+// --- Pure: build pipeline health check command ---
+export function buildPipelineHealthCommand() {
+  return 'curl -s http://localhost:8081/jobs 2>/dev/null | head -20 || echo "flink not reachable"'
+}
+
+// --- Pure: build NATS JetStream status command ---
+export function buildNatsStatusCommand() {
+  return 'curl -s http://localhost:8222/streaming/channelsz 2>/dev/null | head -30 || echo "nats not reachable"'
+}
+
+// --- Pure: build Kafka consumer lag command ---
+export function buildKafkaLagCommand() {
+  return 'kafka-consumer-groups --bootstrap-server localhost:9092 --describe --group fraud-pipeline 2>/dev/null | head -20 || echo "kafka not reachable"'
+}
+
+// --- Pure: parse pipeline health output ---
+export function parsePipelineHealth(output) {
+  const health = { status: 'unknown', jobs: [], running: 0, failed: 0 }
+  try {
+    const parsed = JSON.parse(output)
+    if (parsed.jobs && Array.isArray(parsed.jobs)) {
+      health.jobs = parsed.jobs.map((j) => ({ id: j.jid, name: j.name, status: j.state }))
+      health.running = parsed.jobs.filter((j) => j.state === 'RUNNING').length
+      health.failed = parsed.jobs.filter((j) => j.state === 'FAILED').length
+      health.status = health.failed > 0 ? 'degraded' : health.running > 0 ? 'healthy' : 'unknown'
+    }
+  } catch { /* not JSON */ }
+  return health
+}
+
+// --- Pure: build an STR case record ---
+export function buildStrCase(txnId, decision, indicators, assignedTo) {
+  return {
+    id: `str-${txnId}-${Date.now().toString(36)}`,
+    txnId,
+    decision, // BLOCK | REVIEW
+    indicators: indicators ?? [],
+    assignedTo: assignedTo ?? 'unassigned',
+    status: 'pending', // pending | assigned | reviewed | filed | expired
+    deadline: Date.now() + 7 * 24 * 60 * 60 * 1000, // 7 days (CBN requirement)
+    createdAt: Date.now(),
+  }
+}
+
+// --- Pure: build a decision summary ---
+export function buildDecisionSummary(decisions) {
+  const total = decisions.length
+  const blocks = decisions.filter((d) => d.decision === 'BLOCK').length
+  const reviews = decisions.filter((d) => d.decision === 'REVIEW').length
+  const approves = decisions.filter((d) => d.decision === 'APPROVE').length
+  return {
+    total,
+    blocks,
+    reviews,
+    approves,
+    blockRate: total > 0 ? Math.round((blocks / total) * 100) : 0,
+    reviewRate: total > 0 ? Math.round((reviews / total) * 100) : 0,
+    approveRate: total > 0 ? Math.round((approves / total) * 100) : 0,
+  }
+}
+
+// --- Plugin entry ---
+export function register(ctx) {
+  const { registerTool, registerTrigger, registerPanel, exec, readLedger, log } = ctx
+  const strCases = []
+
+  // Tool: fraudops_pipeline_status — check the health of the fraud pipeline
+  registerTool({
+    name: 'fraudops_pipeline_status',
+    description: 'Check the health of the fraud detection pipeline (Flink jobs, NATS JetStream, Kafka consumer lag). Returns status for each component.',
+    params: {},
+    handler: async () => {
+      const flinkOut = await exec(buildPipelineHealthCommand(), {})
+      const natsOut = await exec(buildNatsStatusCommand(), {})
+      const kafkaOut = await exec(buildKafkaLagCommand(), {})
+      const flink = parsePipelineHealth(flinkOut)
+      log(`[fraudops] pipeline status: flink=${flink.status} nats=${natsOut.slice(0, 50)} kafka=${kafkaOut.slice(0, 50)}`)
+      return { flink, nats: natsOut.slice(0, 500), kafka: kafkaOut.slice(0, 500) }
+    },
+  })
+
+  // Tool: fraudops_str_assign — assign an STR case to an analyst
+  registerTool({
+    name: 'fraudops_str_assign',
+    description: 'Assign an STR (Suspicious Transaction Report) case to an analyst. Creates the case with a 7-day CBN deadline.',
+    params: {
+      txnId: { type: 'string', description: 'Transaction ID' },
+      decision: { type: 'string', description: 'BLOCK or REVIEW' },
+      indicators: { type: 'array', description: 'Fraud indicators (e.g., ["high_velocity", "new_device"])' },
+      assignedTo: { type: 'string', description: 'Analyst username' },
+    },
+    handler: async (params) => {
+      const { txnId, decision, indicators, assignedTo } = params ?? {}
+      if (!txnId || !decision) return { error: 'txnId and decision are required' }
+      const strCase = buildStrCase(txnId, decision, indicators, assignedTo)
+      strCase.status = 'assigned'
+      strCases.push(strCase)
+      log(`[fraudops] STR case ${strCase.id} assigned to ${assignedTo}`)
+      return strCase
+    },
+  })
+
+  // Tool: fraudops_str_status — get STR case status
+  registerTool({
+    name: 'fraudops_str_status',
+    description: 'Get the status of STR cases. Filter by status, analyst, or overdue.',
+    params: {
+      status: { type: 'string', description: 'Filter by status: pending, assigned, reviewed, filed, expired' },
+      assignedTo: { type: 'string', description: 'Filter by analyst' },
+      overdue: { type: 'boolean', description: 'Only show overdue cases (past 7-day deadline)' },
+    },
+    handler: async (params) => {
+      let filtered = [...strCases]
+      if (params?.status) filtered = filtered.filter((c) => c.status === params.status)
+      if (params?.assignedTo) filtered = filtered.filter((c) => c.assignedTo === params.assignedTo)
+      if (params?.overdue) filtered = filtered.filter((c) => Date.now() > c.deadline)
+      return { total: filtered.length, cases: filtered }
+    },
+  })
+
+  // Tool: fraudops_decision_summary — summarize fraud decisions
+  registerTool({
+    name: 'fraudops_decision_summary',
+    description: 'Summarize fraud decisions (BLOCK/REVIEW/APPROVE counts and rates) from the decision stream.',
+    params: {
+      decisions: { type: 'array', description: 'Array of decision objects with { decision: "BLOCK"|"REVIEW"|"APPROVE" }' },
+    },
+    handler: async (params) => {
+      const decisions = params?.decisions ?? []
+      const summary = buildDecisionSummary(decisions)
+      log(`[fraudops] decision summary: ${summary.total} total, ${summary.blockRate}% block, ${summary.reviewRate}% review`)
+      return summary
+    },
+  })
+
+  // Trigger: fraudops_str_overdue — fires when an STR case is overdue
+  registerTrigger({
+    name: 'fraudops_str_overdue',
+    description: 'Fires when an STR case exceeds the 7-day CBN deadline. Use for escalation to senior analyst.',
+    match: (event) => {
+      if (event?.source !== 'fraudops') return false
+      return event.labels?.status === 'expired' || event.labels?.overdue === true
+    },
+    action: 'propose-change',
+  })
+
+  // Trigger: fraudops_pipeline_down — fires when a pipeline component is down
+  registerTrigger({
+    name: 'fraudops_pipeline_down',
+    description: 'Fires when a fraud pipeline component (Flink, NATS, Kafka) is detected as down. Use for immediate incident response.',
+    match: (event) => {
+      if (event?.source !== 'fraudops') return false
+      return event.labels?.status === 'down' || event.labels?.failed === true
+    },
+    action: 'run-playbook',
+  })
+
+  // Panel: fraudops-dashboard — unified fraud operations dashboard
+  registerPanel({
+    name: 'fraudops-dashboard',
+    title: 'Fraud Operations Dashboard',
+    render: (data) => {
+      const cases = Array.isArray(data?.cases) ? data.cases : strCases
+      const summary = data?.summary ?? { total: 0, blocks: 0, reviews: 0, approves: 0, blockRate: 0, reviewRate: 0, approveRate: 0 }
+      const rows = cases.map((c) =>
+        `<tr><td>${c.id}</td><td>${c.txnId}</td><td>${c.decision}</td><td>${c.assignedTo}</td><td>${c.status}</td><td>${new Date(c.deadline).toLocaleDateString()}</td></tr>`
+      ).join('')
+      return `<div class="fraudops-dashboard"><h3>Fraud Operations Dashboard</h3><p>Decisions: ${summary.total} | Block: ${summary.blockRate}% | Review: ${summary.reviewRate}% | Approve: ${summary.approveRate}%</p><p>STR Cases: ${cases.length} | Overdue: ${cases.filter((c) => Date.now() > c.deadline).length}</p><table><thead><tr><th>ID</th><th>Txn ID</th><th>Decision</th><th>Assigned</th><th>Status</th><th>Deadline</th></tr></thead><tbody>${rows}</tbody></table></div>`
+    },
+  })
+
+  log('[fraudops] registered: 4 tools, 2 triggers, 1 panel')
+}
+
+export default { register, buildPipelineHealthCommand, buildNatsStatusCommand, buildKafkaLagCommand, parsePipelineHealth, buildStrCase, buildDecisionSummary }

package/plugins/fraudops/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "fraudops",
+  "version": "1.0.0",
+  "description": "FraudOps for RTerm — operational layer for the fraud detection pipeline. Monitors pipeline health (Flink, NATS, Kafka), manages STR workflow, tracks fraud incidents, and provides the unified fraud operations dashboard. Bridges Kafka/NATS metrics into RTerm's SRE pillar.",
+  "entry": "index.mjs",
+  "tools": ["fraudops_pipeline_status", "fraudops_str_assign", "fraudops_str_status", "fraudops_decision_summary"],
+  "triggers": ["fraudops_str_overdue", "fraudops_pipeline_down"],
+  "panels": ["fraudops-dashboard"],
+  "permissions": ["exec", "readLedger:metrics", "readLedger:incidents"]
+}

package/plugins/iam-connector/index.d.mts

@@ -0,0 +1,10 @@
+// iam-connector plugin type declarations
+export function register(ctx: any): void
+export function buildUserInfoCommand(username: string, os?: string): string
+export function buildUserGroupsCommand(username: string, os?: string): string
+export function buildDisableUserCommand(username: string, os?: string): string
+export function buildAccessReviewCommand(os?: string): string
+export function parseUserInfo(output: string, os?: string): { username: string; groups: string[]; enabled: boolean; locked: boolean }
+export function parseAccessReview(output: string, os?: string): Array<{ username: string; groups?: string[]; enabled?: boolean }>
+export function isPrivileged(userInfo: { groups: string[] }, privilegedGroups?: string[]): boolean
+export default any

package/plugins/iam-connector/index.mjs

@@ -0,0 +1,225 @@
+/**
+ * iam-connector plugin — IAM integration for RTerm.
+ *
+ * User/group management, role assignment, access review, and audit trail for
+ * Active Directory, local users, and service accounts. Covers user lifecycle
+ * (create, disable, offboard), group membership, and access compliance.
+ * Commands are built for both Linux (id, groups, usermod) and Windows
+ * (Get-LocalUser, Get-LocalGroupMember, Disable-LocalUser).
+ */
+
+// --- Pure: build user info command ---
+export function buildUserInfoCommand(username, os = 'linux') {
+  const o = String(os).toLowerCase()
+  if (o === 'windows' || o === 'win32') {
+    return `powershell -Command "Get-LocalUser -Name '${username}' | Select-Object Name,Enabled,LastLogon,PasswordExpires,LockedOut,Description | Format-List"`
+  }
+  return `id '${username}' 2>/dev/null && groups '${username}' 2>/dev/null && passwd -S '${username}' 2>/dev/null`
+}
+
+// --- Pure: build user groups command ---
+export function buildUserGroupsCommand(username, os = 'linux') {
+  const o = String(os).toLowerCase()
+  if (o === 'windows' || o === 'win32') {
+    return `powershell -Command "Get-LocalGroupMember -Group Administrators | Where-Object {$_.Name -like '*${username}*'} | Select-Object Name; Get-LocalUser -Name '${username}' | Select-Object Name,Enabled"`
+  }
+  return `groups '${username}' 2>/dev/null && id -Gn '${username}' 2>/dev/null`
+}
+
+// --- Pure: build disable user command ---
+export function buildDisableUserCommand(username, os = 'linux') {
+  const o = String(os).toLowerCase()
+  if (o === 'windows' || o === 'win32') {
+    return `powershell -Command "Disable-LocalUser -Name '${username}'; Get-LocalUser -Name '${username}' | Select-Object Name,Enabled"`
+  }
+  return `usermod -L '${username}' 2>/dev/null && echo "user ${username} disabled" || echo "failed to disable ${username}"`
+}
+
+// --- Pure: build access review command (list all users + groups) ---
+export function buildAccessReviewCommand(os = 'linux') {
+  const o = String(os).toLowerCase()
+  if (o === 'windows' || o === 'win32') {
+    return 'powershell -Command "Get-LocalUser | Select-Object Name,Enabled,LastLogon | Format-Table -AutoSize; Write-Host \'---\'; Get-LocalGroup | Select-Object Name | Format-Table -AutoSize"'
+  }
+  return 'cut -d: -f1 /etc/passwd | while read u; do echo "$u: $(id -Gn $u 2>/dev/null)"; done 2>/dev/null | head -50'
+}
+
+// --- Pure: parse user info output ---
+export function parseUserInfo(output, os = 'linux') {
+  const o = String(os).toLowerCase()
+  const info = { username: '', groups: [], enabled: true, locked: false }
+
+  if (o === 'windows' || o === 'win32') {
+    const nameMatch = output.match(/Name\s+:\s+(\S+)/)
+    const enabledMatch = output.match(/Enabled\s+:\s+(True|False)/i)
+    const lockedMatch = output.match(/LockedOut\s+:\s+(True|False)/i)
+    if (nameMatch) info.username = nameMatch[1]
+    if (enabledMatch) info.enabled = enabledMatch[1].toLowerCase() === 'true'
+    if (lockedMatch) info.locked = lockedMatch[1].toLowerCase() === 'true'
+    return info
+  }
+
+  // Linux: parse id + groups + passwd -S output
+  const lines = output.split(/\r?\n/)
+  for (const line of lines) {
+    const l = line.trim()
+    const idMatch = l.match(/uid=\d+\((\S+)\)/)
+    if (idMatch) info.username = idMatch[1]
+    const groupsMatch = l.match(/groups=(.+)/)
+    if (groupsMatch) {
+      // groups=1000(john),27(sudo) — split by comma, then extract names from NNN(name) format
+      info.groups = groupsMatch[1]
+        .split(',')
+        .map((g) => g.replace(/\d+\(([^)]+)\)/, '$1').trim())
+        .filter(Boolean)
+    }
+    if (l.includes(' L ')) info.locked = true
+  }
+  return info
+}
+
+// --- Pure: parse access review output into a user list ---
+export function parseAccessReview(output, os = 'linux') {
+  const o = String(os).toLowerCase()
+  const users = []
+
+  if (o === 'windows' || o === 'win32') {
+    const lines = output.split(/\r?\n/)
+    for (const line of lines) {
+      const l = line.trim()
+      const match = l.match(/^(\S+)\s+(True|False)\s+/)
+      if (match) {
+        users.push({ username: match[1], enabled: match[2].toLowerCase() === 'true' })
+      }
+    }
+    return users
+  }
+
+  // Linux: parse "user: group1 group2" lines
+  const lines = output.split(/\r?\n/)
+  for (const line of lines) {
+    const l = line.trim()
+    const match = l.match(/^(\S+):\s*(.*)/)
+    if (match) {
+      users.push({ username: match[1], groups: match[2].split(/\s+/).filter(Boolean) })
+    }
+  }
+  return users
+}
+
+// --- Pure: check if a user has privileged access ---
+export function isPrivileged(userInfo, privilegedGroups = ['sudo', 'wheel', 'admin', 'root', 'Administrators']) {
+  return userInfo.groups.some((g) => privilegedGroups.some((pg) => g.toLowerCase().includes(pg.toLowerCase())))
+}
+
+// --- Plugin entry ---
+export function register(ctx) {
+  const { registerTool, registerTrigger, registerPanel, exec, readLedger, log } = ctx
+
+  // Tool: iam_user_info — get user info
+  registerTool({
+    name: 'iam_user_info',
+    description: 'Get user information (username, groups, enabled status, locked status) for a user on a host.',
+    params: {
+      username: { type: 'string', description: 'Username to query' },
+      host: { type: 'string', description: 'Host to query' },
+      os: { type: 'string', description: 'OS type: linux, windows' },
+    },
+    handler: async (params) => {
+      const { username, host, os = 'linux' } = params ?? {}
+      if (!username || !host) return { error: 'username and host are required' }
+      const cmd = buildUserInfoCommand(username, os)
+      log(`[iam-connector] querying user ${username} on ${host}`)
+      const output = await exec(cmd, { host })
+      const info = parseUserInfo(output, os)
+      return { username, host, os, ...info, privileged: isPrivileged(info) }
+    },
+  })
+
+  // Tool: iam_user_groups — get user group memberships
+  registerTool({
+    name: 'iam_user_groups',
+    description: 'Get group memberships for a user on a host.',
+    params: {
+      username: { type: 'string', description: 'Username to query' },
+      host: { type: 'string', description: 'Host to query' },
+      os: { type: 'string', description: 'OS type' },
+    },
+    handler: async (params) => {
+      const { username, host, os = 'linux' } = params ?? {}
+      if (!username || !host) return { error: 'username and host are required' }
+      const cmd = buildUserGroupsCommand(username, os)
+      const output = await exec(cmd, { host })
+      const info = parseUserInfo(output, os)
+      return { username, host, groups: info.groups, privileged: isPrivileged(info) }
+    },
+  })
+
+  // Tool: iam_disable_user — disable a user account (requires approval)
+  registerTool({
+    name: 'iam_disable_user',
+    description: 'Disable a user account on a host. This is a destructive operation — requires approval. Returns the result.',
+    params: {
+      username: { type: 'string', description: 'Username to disable' },
+      host: { type: 'string', description: 'Host to disable on' },
+      os: { type: 'string', description: 'OS type' },
+    },
+    handler: async (params) => {
+      const { username, host, os = 'linux' } = params ?? {}
+      if (!username || !host) return { error: 'username and host are required' }
+      const cmd = buildDisableUserCommand(username, os)
+      log(`[iam-connector] disabling user ${username} on ${host}`)
+      const output = await exec(cmd, { host })
+      const info = parseUserInfo(output, os)
+      return { username, host, disabled: !info.enabled, output: output.slice(0, 500) }
+    },
+  })
+
+  // Tool: iam_access_review — review all user access on a host
+  registerTool({
+    name: 'iam_access_review',
+    description: 'Review all user accounts and group memberships on a host. Identifies privileged users.',
+    params: {
+      host: { type: 'string', description: 'Host to review' },
+      os: { type: 'string', description: 'OS type' },
+    },
+    handler: async (params) => {
+      const { host, os = 'linux' } = params ?? {}
+      if (!host) return { error: 'host is required' }
+      const cmd = buildAccessReviewCommand(os)
+      const output = await exec(cmd, { host })
+      const users = parseAccessReview(output, os)
+      const privilegedUsers = users.filter((u) => isPrivileged({ groups: u.groups ?? [] }))
+      return { host, totalUsers: users.length, privilegedUsers: privilegedUsers.length, users: users.slice(0, 50), privilegedUsers: privilegedUsers.map((u) => u.username) }
+    },
+  })
+
+  // Trigger: iam_privileged_change — fires when a privileged user's access changes
+  registerTrigger({
+    name: 'iam_privileged_change',
+    description: 'Fires when a privileged user account is modified (disabled, group change). Use for compliance monitoring.',
+    match: (event) => {
+      if (event?.source !== 'iam-connector') return false
+      return event.labels?.privileged === true
+    },
+    action: 'propose-change',
+  })
+
+  // Panel: iam-access-dashboard — IAM access dashboard
+  registerPanel({
+    name: 'iam-access-dashboard',
+    title: 'IAM Access Dashboard',
+    render: (data) => {
+      const users = Array.isArray(data) ? data : []
+      const privileged = users.filter((u) => isPrivileged({ groups: u.groups ?? [] }))
+      const rows = users.map((u) =>
+        `<tr><td>${u.username}</td><td>${(u.groups ?? []).join(', ')}</td><td>${u.enabled !== false ? '✅' : '❌'}</td><td>${isPrivileged({ groups: u.groups ?? [] }) ? '🔐' : ''}</td></tr>`
+      ).join('')
+      return `<div class="iam-access-dashboard"><h3>IAM Access Dashboard</h3><p>Total users: ${users.length} | Privileged: ${privileged.length}</p><table><thead><tr><th>User</th><th>Groups</th><th>Enabled</th><th>Privileged</th></tr></thead><tbody>${rows}</tbody></table></div>`
+    },
+  })
+
+  log('[iam-connector] registered: 4 tools, 1 trigger, 1 panel')
+}
+
+export default { register, buildUserInfoCommand, buildUserGroupsCommand, buildDisableUserCommand, buildAccessReviewCommand, parseUserInfo, parseAccessReview, isPrivileged }

package/plugins/iam-connector/plugin.json

@@ -0,0 +1,10 @@
+{
+  "name": "iam-connector",
+  "version": "1.0.0",
+  "description": "IAM integration for RTerm — user/group management, role assignment, access review, and audit trail for Active Directory, local users, and service accounts. Covers user lifecycle (create, disable, offboard), group membership, and access compliance.",
+  "entry": "index.mjs",
+  "tools": ["iam_user_info", "iam_user_groups", "iam_disable_user", "iam_access_review"],
+  "triggers": ["iam_privileged_change"],
+  "panels": ["iam-access-dashboard"],
+  "permissions": ["exec", "readLedger:incidents"]
+}