{ "$schema": "https://uipkge.dev/schema/registry-item.json", "name": "security-incident-timeline", "title": "Security Incident Timeline", "type": "registry:block", "files": [ { "path": "packages/registry-angular/blocks/security-incident-timeline/security-incident-timeline.component.ts", "content": "// Security Operations Center (SOC) incident response timeline and post-mortem\n// tracker: telemetry KPIs, chronological audit trail with log snippets, and\n// corrective action items. Port of the React block 1:1.\nimport { ChangeDetectionStrategy, Component, Input, signal } from '@angular/core'\nimport {\n Check,\n CheckCircle2,\n Clock,\n Copy,\n FileCheck,\n FileDown,\n GitPullRequest,\n KeyRound,\n Lock,\n LucideAngularModule,\n Plus,\n Radio,\n Server,\n Shield,\n ShieldAlert,\n ShieldCheck,\n Terminal,\n Users,\n Zap,\n} from 'lucide-angular'\nimport { cn } from '@/lib/utils'\nimport { UiAvatarComponent, UiAvatarFallbackComponent, UiAvatarImageComponent } from '@/ui/avatar/avatar.component'\nimport { UiBadgeComponent } from '@/ui/badge/badge.component'\nimport { UiButtonComponent } from '@/ui/button/button.component'\nimport {\n UiCardComponent,\n UiCardContentComponent,\n UiCardDescriptionComponent,\n UiCardHeaderComponent,\n UiCardTitleComponent,\n} from '@/ui/card/card.component'\nimport { UiCheckboxComponent } from '@/ui/checkbox/checkbox.component'\nimport { UiSeparatorComponent } from '@/ui/separator/separator.component'\n\nconst logSnippets: Record = {\n detection: `[2026-08-21T14:12:08.104Z] GUARDDUTY_ALERT: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS\nPrincipalId: AROA4491X0921:github-worker-ephemeral-tok_88f9x\nRequestedRole: arn:aws:iam::102938475612:role/SuperAdminPolicy\nSourceIP: 198.51.100.42 (Tor Exit Node AS13335) | UserAgent: aws-cli/2.15.30 Python/3.11.8\nRiskScore: 98/100 | FindingId: gd-find-8891-c0a1-992a | Action: STS:AssumeRoleWithWebIdentity`,\n\n triage: `[2026-08-21T14:15:30.412Z] INCIDENT_WAR_ROOM_ESTABLISHED: bridge_id=bridge_sec_0842\nIncidentCommander: elena.rostova@acme.corp | Responders: [m.vance, d.okoye, j.chen]\nVectorAnalysis: Ephemeral token tok_88f9x generated in GH Actions workflow run #1049281.\nScopeAssessment: Ingress proxy read cache queried; zero write or database mutation detected.\nEscalationLevel: SEV-1 (Paging IAM + Platform on-call)`,\n\n containment: `[2026-08-21T14:22:15.890Z] CLOUDFLARE_WAF_ENFORCED: rule_id=sec_block_tor_asn_13335 action=BLOCK\nGatewaysSynced: [apigw-iad-prod-01, apigw-iad-prod-02, apigw-iad-prod-03] (3/3 nodes OK)\nActiveConnectionsDropped: 14 concurrent TCP streams | RateLimit: 0 req/sec allowed from source\nEgressQuarantine: ALL external routes from adversary subnet blackholed.`,\n\n revocation: `[2026-08-21T14:30:53.002Z] VAULT_REVOCATION_BROADCAST: lease_prefix=auth/token/tok_88f9x leases_revoked=38\nKMS_KEY_ROTATED: arn:aws:kms:us-east-1:102938475612:key/cmk-gateway-signing-02 -> key_version_v3\nRedisClusterBroadcast: AUTH_CACHE_PURGE_SUCCESS (12/12 shards synchronized in 84ms)\nTokenVerificationState: REVOCATION_COMPLETE (0 surviving tokens)`,\n\n postmortem: `[2026-08-21T14:48:00.651Z] SOC_AUDIT_SWEEP: duration=15m00s | unauthorized_calls=0 | perimeter_status=NOMINAL\nIncidentStatusTransition: SEV-1_ACTIVE -> MITIGATED_POST_MORTEM\nForensicsArchive: s3://sec-incident-vault-us-east-1/incidents/2026-0842/evidence_bundle.tar.gz.enc\nEvidenceSignOff: [m.vance, e.rostova] | Hash: sha256:7f83b1657ff1fc53b92dc18148a1d65`,\n}\n\n@Component({\n changeDetection: ChangeDetectionStrategy.Eager,\n selector: 'ui-security-incident-timeline, [ui-security-incident-timeline]',\n standalone: true,\n // React renders the root
itself: the host stays out of layout and `class` goes to the root.\n host: { '[attr.class]': '\"contents\"' },\n imports: [\n LucideAngularModule,\n UiAvatarComponent,\n UiAvatarFallbackComponent,\n UiAvatarImageComponent,\n UiBadgeComponent,\n UiButtonComponent,\n UiCardComponent,\n UiCardContentComponent,\n UiCardDescriptionComponent,\n UiCardHeaderComponent,\n UiCardTitleComponent,\n UiCheckboxComponent,\n UiSeparatorComponent,\n ],\n template: `\n
\n \n
\n
\n
\n
\n \n
\n \n {{ incidentId }}\n \n\n \n \n \n \n \n \n {{ severity }}\n \n\n \n @if (!isResolved()) {\n \n \n {{ status }}\n \n } @else {\n \n \n Resolved · Closed\n \n }\n\n \n Region: us-east-1 (N. Virginia)\n \n
\n\n \n
\n

\n {{ incidentTitle }}\n

\n

\n Adversarial AWS STS role assumption anomaly flagged across external ingress gateways. Compromised\n ephemeral CI/CD workflow token quarantined and revoked in 18 minutes.\n

\n
\n
\n\n \n
\n \n @if (exportNotification()) {\n \n } @else {\n \n }\n {{ exportNotification() ? 'Exporting PDF...' : 'Export Incident Report PDF' }}\n \n\n \n\n \n \n {{ isResolved() ? 'Re-open Incident' : 'Resolve Incident' }}\n \n
\n
\n\n \n\n \n
\n
\n \n \n MV\n \n
\n

Incident Commander

\n

{{ commanderName }}

\n

{{ commanderRole }}

\n
\n
\n\n
\n

Detection Trigger

\n

GuardDuty · IAM.Anomaly.STS

\n

2026-08-21 14:12:08 UTC

\n
\n\n
\n

Threat Vector & Origin

\n

198.51.100.42 (Tor Exit Node)

\n

AS13335 · Ephemeral OIDC Leak

\n
\n\n
\n

Incident War Room

\n
\n \n \n \n \n

#bridge-sec-0842

\n 4 Responders\n
\n

Bridge active · PagerDuty Sync

\n
\n
\n
\n
\n\n \n
\n \n
\n
\n
\n

Time to Detect (TTD)

\n \n \n
\n
\n
\n
4m 12s
\n

\n \n Automated GuardDuty alert fired\n

\n
\n
\n
\n\n \n
\n
\n
\n

Time to Mitigate (TTM)

\n \n \n
\n
\n
\n
18m 45s
\n

\n \n Full perimeter isolation & rotation\n

\n
\n
\n
\n\n \n
\n
\n
\n

Affected Resources

\n \n \n
\n
\n
\n
3 Gateways
\n

\n apigw-iad-prod-[01..03]\n

\n
\n
\n
\n\n \n
\n
\n
\n

Impacted User Accounts

\n \n \n
\n
\n
\n
0 Compromised
\n

\n \n 0 compromise confirmed · Token revoked\n

\n
\n
\n \n \n\n \n
\n
\n
\n
\n
Incident Response Timeline
\n
\n Chronological audit trail of SOC telemetry, containment actions, and mitigation milestones.\n
\n
\n
\n 5 Timeline Events · UTC Synchronized \n
\n
\n
\n\n
\n \n \n
\n \n \n
\n\n
\n
\n 2026-08-21T14:12:08Z\n 1. Detection \n T+00:00 \n

Automated Detection & Anomaly Ingestion

\n
\n\n
\n \n \n MV\n \n Marcus Vance\n (SecOps Lead)\n
\n
\n\n
\n

Action Taken:

\n

\n AWS GuardDuty anomaly engine flagged an unauthorized STS AssumeRole policy elevation request targeting\n role/SuperAdminPolicy\n from an unapproved Tor exit node. Ingestion webhook routed alert to PagerDuty SecOps on-call.\n

\n
\n\n
\n
\n
\n \n guardduty_alert_stream.log\n
\n \n @if (copiedSnippetId() === 'detection') {\n \n } @else {\n \n }\n {{ copiedSnippetId() === 'detection' ? 'Copied' : 'Copy Snippet' }}\n \n
\n {{ logSnippets.detection }}\n
\n\n
\n Mitigation Notes: \n \n Perimeter rate-limiting threshold exceeded (52 req/s). SIEM correlated 4 duplicate elevation\n signatures across edge ingress gateways.\n \n
\n
\n\n \n
\n \n \n
\n\n
\n
\n 2026-08-21T14:15:30Z\n 2. Triage \n T+03:22 \n

SOC Triage & Incident War Room Assembly

\n
\n\n
\n \n \n ER\n \n Elena Rostova\n (Incident Commander)\n
\n
\n\n
\n

Action Taken:

\n

\n PagerDuty SEV-1 broadcast dispatched. Assembled SecOps, IAM, and Core Infrastructure leads in primary\n war room. Traced origin token\n tok_88f9x to an\n ephemeral CI/CD GitHub Actions runner.\n

\n
\n\n
\n
\n
\n \n war_room_triage_audit.log\n
\n \n @if (copiedSnippetId() === 'triage') {\n \n } @else {\n \n }\n {{ copiedSnippetId() === 'triage' ? 'Copied' : 'Copy Snippet' }}\n \n
\n {{ logSnippets.triage }}\n
\n\n
\n Mitigation Notes: \n \n Confirmed unauthorized token attempt was using leaked CI/CD ephemeral workflow credential tok_88f9x.\n Scope bounded strictly to read-only API gateway routing.\n \n
\n
\n\n \n
\n \n \n
\n\n
\n
\n 2026-08-21T14:22:15Z\n 3. Containment \n T+10:07 \n

Perimeter Quarantine & Traffic Blackholing

\n
\n\n
\n \n \n DO\n \n David Okoye\n (Network Security)\n
\n
\n\n
\n

Action Taken:

\n

\n Cloudflare WAF dynamic block rule enforced for egress IP ASN block (AS13335). Automated session kill\n command dispatched across all 3 production ingress proxy gateway clusters.\n

\n
\n\n
\n
\n
\n \n perimeter_waf_quarantine.log\n
\n \n @if (copiedSnippetId() === 'containment') {\n \n } @else {\n \n }\n {{ copiedSnippetId() === 'containment' ? 'Copied' : 'Copy Snippet' }}\n \n
\n {{ logSnippets.containment }}\n
\n\n
\n Mitigation Notes: \n \n Ingress gateways returned HTTP 403 Forbidden. External traffic from adversarial IP ranges suppressed\n with 0 packet leak into VPC internal mesh.\n \n
\n \n\n \n
\n \n \n
\n\n
\n
\n 2026-08-21T14:30:53Z\n 4. Token Revocation \n T+18:45 \n

\n Cryptographic Credential Invalidation & Key Rotation\n

\n
\n\n
\n \n \n JC\n \n Jessica Chen\n (IAM Engineering)\n
\n
\n\n
\n

Action Taken:

\n

\n Revoked compromised GitHub Actions OIDC token series in AWS IAM & HashiCorp Vault. Rotated parent\n cluster KMS gateway signing keys and flushed authentication verification caches across Redis mesh.\n

\n
\n\n
\n
\n
\n \n vault_revocation_kms_rotation.log\n
\n \n @if (copiedSnippetId() === 'revocation') {\n \n } @else {\n \n }\n {{ copiedSnippetId() === 'revocation' ? 'Copied' : 'Copy Snippet' }}\n \n
\n {{ logSnippets.revocation }}\n
\n\n
\n Mitigation Notes: \n \n All downstream JWT verification caches invalidated via Redis Pub/Sub broadcast in 84ms. Zero active\n token survivability confirmed.\n \n
\n \n\n \n
\n \n \n
\n\n
\n
\n 2026-08-21T14:48:00Z\n \n 5. Post-Mortem Action Items\n \n T+35:52 \n

\n Threat Vector Neutralized & Post-Mortem Transition\n

\n
\n\n
\n \n \n MV\n \n Marcus Vance\n (SecOps Lead)\n
\n
\n\n
\n

Action Taken:

\n

\n Completed 15-minute clean traffic audit sweep with 0 anomalous requests. Incident commander officially\n downgraded active SEV-1 to Mitigated status and initiated formal post-mortem action items.\n

\n
\n\n
\n
\n
\n \n post_incident_audit_sweep.log\n
\n \n @if (copiedSnippetId() === 'postmortem') {\n \n } @else {\n \n }\n {{ copiedSnippetId() === 'postmortem' ? 'Copied' : 'Copy Snippet' }}\n \n
\n {{ logSnippets.postmortem }}\n
\n\n
\n Mitigation Notes: \n \n Post-incident evidence bundle archived to secure S3 vault bucket\n s3://sec-incidents-2026/0842-audit.tar.gz.enc. Remediation tasks assigned.\n \n
\n \n \n \n \n\n \n
\n
\n
\n
\n
\n \n
Root Cause Analysis & Corrective Action Items
\n
\n
\n 3 actionable remediation tasks tracked across Jira and GitHub to prevent recurring authorization bypass\n vectors.\n
\n
\n 3 Post-Mortem Tasks \n
\n
\n\n
\n \n
\n
\n \n Root Cause Summary\n
\n

\n A third-party fork pull request executed via a workflow using\n pull_request_target allowed\n unauthorized extraction of the short-lived CI OIDC token. AWS STS role trust policy lacked strict\n repository_owner and\n ref claim constraints.\n

\n
\n\n \n
\n \n \n
\n
\n \n
\n
\n
\n \n P0 Blocker\n In Review\n
\n

\n Enforce strict OIDC branch-to-role binding with repository claim validation on CI runner STS\n policies\n

\n

\n Require repository_owner=uipkge and\n ref=refs/heads/main on all assumed cloud roles.\n

\n
\n
\n\n
\n
\n \n \n JC\n \n Jessica Chen\n
\n \n \n PR #882\n \n
\n
\n\n \n \n
\n
\n \n
\n
\n
\n \n P1 High\n Completed\n
\n

\n Reduce default ephemeral CI token TTL from 3600s to 900s across all GitHub Actions deployment\n workflows\n

\n

\n Update HashiCorp Vault AWS secrets engine configuration and OIDC provider default duration.\n

\n
\n
\n\n
\n
\n \n \n DO\n \n David Okoye\n
\n Deployed v4.18.2 \n
\n
\n\n \n \n
\n
\n \n
\n
\n
\n \n P1 High\n In Progress\n
\n

\n Implement automated SIEM quarantine webhook to auto-revoke Vault tokens upon GuardDuty high-severity\n finding\n

\n

\n Deploy AWS EventBridge rule to pipe GuardDuty high-severity IAM alerts directly to Lambda quarantine\n webhook.\n

\n
\n
\n\n
\n
\n \n \n MV\n \n Marcus Vance\n
\n Sprint 34 · Aug 28 \n
\n
\n \n \n \n \n `,\n})\nexport class UiSecurityIncidentTimelineComponent {\n protected readonly Check = Check\n protected readonly CheckCircle2 = CheckCircle2\n protected readonly Clock = Clock\n protected readonly Copy = Copy\n protected readonly FileCheck = FileCheck\n protected readonly FileDown = FileDown\n protected readonly GitPullRequest = GitPullRequest\n protected readonly KeyRound = KeyRound\n protected readonly Lock = Lock\n protected readonly Plus = Plus\n protected readonly Radio = Radio\n protected readonly Server = Server\n protected readonly Shield = Shield\n protected readonly ShieldAlert = ShieldAlert\n protected readonly ShieldCheck = ShieldCheck\n protected readonly Terminal = Terminal\n protected readonly Users = Users\n protected readonly Zap = Zap\n\n protected readonly logSnippets = logSnippets\n\n @Input() incidentId = '#SEC-INC-2026-0842'\n @Input() incidentTitle = 'Unauthorized API Token Elevation Attempt'\n @Input() severity = 'SEV-1 Critical'\n @Input() status = 'Mitigated / In Post-Mortem'\n @Input() commanderName = 'Marcus Vance'\n @Input() commanderRole = 'Principal SecOps · Incident Commander'\n @Input('class') className?: string\n\n readonly isResolved = signal(false)\n readonly exportNotification = signal(false)\n readonly copiedSnippetId = signal(null)\n readonly updateAddedNotification = signal(false)\n\n readonly actionItem1 = signal(true)\n readonly actionItem2 = signal(true)\n readonly actionItem3 = signal(false)\n\n get rootClass(): string {\n return cn('w-full space-y-6', this.className)\n }\n\n taskLabelClass(done: boolean): string {\n return cn(\n 'cursor-pointer font-mono text-xs font-bold',\n done ? 'text-muted-foreground line-through' : 'text-foreground',\n )\n }\n\n taskDescClass(done: boolean): string {\n return cn('text-xs font-medium', done ? 'text-muted-foreground line-through' : 'text-foreground')\n }\n\n copySnippet(id: string): void {\n const text = logSnippets[id]\n if (!text) return\n try {\n void navigator.clipboard.writeText(text)\n } catch {\n // Clipboard unavailable: still flip the label.\n }\n this.copiedSnippetId.set(id)\n setTimeout(() => {\n if (this.copiedSnippetId() === id) this.copiedSnippetId.set(null)\n }, 2000)\n }\n\n handleExportPdf(): void {\n this.exportNotification.set(true)\n setTimeout(() => this.exportNotification.set(false), 2500)\n }\n\n handleAddUpdate(): void {\n this.updateAddedNotification.set(true)\n setTimeout(() => this.updateAddedNotification.set(false), 2500)\n }\n\n handleResolve(): void {\n this.isResolved.update((v) => !v)\n }\n}\n", "type": "registry:block", "target": "~/src/app/components/blocks/security-incident-timeline/security-incident-timeline.component.ts" }, { "path": "packages/registry-angular/blocks/security-incident-timeline/index.ts", "content": "export { UiSecurityIncidentTimelineComponent } from './security-incident-timeline.component'\n", "type": "registry:block", "target": "~/src/app/components/blocks/security-incident-timeline/index.ts" } ], "dependencies": [ "lucide-angular" ], "devDependencies": [], "registryDependencies": [ "https://uipkge.dev/r/angular/avatar.json", "https://uipkge.dev/r/angular/badge.json", "https://uipkge.dev/r/angular/button.json", "https://uipkge.dev/r/angular/card.json", "https://uipkge.dev/r/angular/checkbox.json", "https://uipkge.dev/r/angular/separator.json" ], "description": "Security Operations Center (SOC) incident response timeline and post-mortem tracker with telemetry KPIs, chronological audit trail, log snippets, and corrective action items.", "categories": [ "security", "app", "devops" ] }