{ "$schema": "https://ui.shadcn.com/schema/registry-item.json", "name": "security-incident-timeline", "title": "Security Incident Timeline", "type": "registry:block", "files": [ { "path": "packages/registry-react/blocks/security-incident-timeline/SecurityIncidentTimeline.tsx", "content": "'use client'\n\nimport * as React from 'react'\nimport {\n Check,\n CheckCircle2,\n Clock,\n Copy,\n FileCheck,\n FileDown,\n GitPullRequest,\n KeyRound,\n Lock,\n Plus,\n Radio,\n Server,\n Shield,\n ShieldAlert,\n ShieldCheck,\n Terminal,\n Users,\n Zap,\n} from 'lucide-react'\nimport { cn } from '@/lib/utils'\nimport { Avatar, AvatarFallback, AvatarImage } from '@/components/ui/avatar'\nimport { Badge } from '@/components/ui/badge'\nimport { Button } from '@/components/ui/button'\nimport { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'\nimport { Checkbox } from '@/components/ui/checkbox'\nimport { Separator } from '@/components/ui/separator'\n\nexport interface SecurityIncidentTimelineProps extends React.HTMLAttributes {\n incidentId?: string\n incidentTitle?: string\n severity?: string\n status?: string\n commanderName?: string\n commanderRole?: string\n}\n\nconst logSnippets: Record = {\n detection: `[2026-08-21T14:12:08.104Z] GUARDDUTY_ALERT: UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS\nPrincipalId: AROA4491X0921:github-worker-ephemeral-tok_88f9x\nRequestedRole: arn:aws:iam::102938475612:role/SuperAdminPolicy\nSourceIP: 198.51.100.42 (Tor Exit Node AS13335) | UserAgent: aws-cli/2.15.30 Python/3.11.8\nRiskScore: 98/100 | FindingId: gd-find-8891-c0a1-992a | Action: STS:AssumeRoleWithWebIdentity`,\n\n triage: `[2026-08-21T14:15:30.412Z] INCIDENT_WAR_ROOM_ESTABLISHED: bridge_id=bridge_sec_0842\nIncidentCommander: elena.rostova@acme.corp | Responders: [m.vance, d.okoye, j.chen]\nVectorAnalysis: Ephemeral token tok_88f9x generated in GH Actions workflow run #1049281.\nScopeAssessment: Ingress proxy read cache queried; zero write or database mutation detected.\nEscalationLevel: SEV-1 (Paging IAM + Platform on-call)`,\n\n containment: `[2026-08-21T14:22:15.890Z] CLOUDFLARE_WAF_ENFORCED: rule_id=sec_block_tor_asn_13335 action=BLOCK\nGatewaysSynced: [apigw-iad-prod-01, apigw-iad-prod-02, apigw-iad-prod-03] (3/3 nodes OK)\nActiveConnectionsDropped: 14 concurrent TCP streams | RateLimit: 0 req/sec allowed from source\nEgressQuarantine: ALL external routes from adversary subnet blackholed.`,\n\n revocation: `[2026-08-21T14:30:53.002Z] VAULT_REVOCATION_BROADCAST: lease_prefix=auth/token/tok_88f9x leases_revoked=38\nKMS_KEY_ROTATED: arn:aws:kms:us-east-1:102938475612:key/cmk-gateway-signing-02 -> key_version_v3\nRedisClusterBroadcast: AUTH_CACHE_PURGE_SUCCESS (12/12 shards synchronized in 84ms)\nTokenVerificationState: REVOCATION_COMPLETE (0 surviving tokens)`,\n\n postmortem: `[2026-08-21T14:48:00.651Z] SOC_AUDIT_SWEEP: duration=15m00s | unauthorized_calls=0 | perimeter_status=NOMINAL\nIncidentStatusTransition: SEV-1_ACTIVE -> MITIGATED_POST_MORTEM\nForensicsArchive: s3://sec-incident-vault-us-east-1/incidents/2026-0842/evidence_bundle.tar.gz.enc\nEvidenceSignOff: [m.vance, e.rostova] | Hash: sha256:7f83b1657ff1fc53b92dc18148a1d65`,\n}\n\nexport function SecurityIncidentTimeline({\n incidentId = '#SEC-INC-2026-0842',\n incidentTitle = 'Unauthorized API Token Elevation Attempt',\n severity = 'SEV-1 Critical',\n status = 'Mitigated / In Post-Mortem',\n commanderName = 'Marcus Vance',\n commanderRole = 'Principal SecOps · Incident Commander',\n className,\n ...props\n}: SecurityIncidentTimelineProps) {\n const [isResolved, setIsResolved] = React.useState(false)\n const [exportNotification, setExportNotification] = React.useState(false)\n const [updateAddedNotification, setUpdateAddedNotification] = React.useState(false)\n const [copiedSnippetId, setCopiedSnippetId] = React.useState(null)\n\n const [actionItem1, setActionItem1] = React.useState(true)\n const [actionItem2, setActionItem2] = React.useState(true)\n const [actionItem3, setActionItem3] = React.useState(false)\n\n const copySnippet = (id: string) => {\n const text = logSnippets[id]\n if (!text) return\n if (typeof navigator !== 'undefined' && navigator.clipboard) {\n navigator.clipboard.writeText(text)\n setCopiedSnippetId(id)\n setTimeout(() => {\n setCopiedSnippetId((prev) => (prev === id ? null : prev))\n }, 2000)\n }\n }\n\n const handleExportPdf = () => {\n setExportNotification(true)\n setTimeout(() => {\n setExportNotification(false)\n }, 2500)\n }\n\n const handleAddUpdate = () => {\n setUpdateAddedNotification(true)\n setTimeout(() => {\n setUpdateAddedNotification(false)\n }, 2500)\n }\n\n const handleResolve = () => {\n setIsResolved((prev) => !prev)\n }\n\n return (\n
\n {/* 1. Incident Header Card */}\n \n \n
\n
\n {/* Badge Metadata Bar */}\n
\n \n {incidentId}\n \n\n {/* Severity Badge with Pulsing Red Dot */}\n \n \n \n \n \n {severity}\n \n\n {/* Status Badge */}\n {!isResolved ? (\n \n \n {status}\n \n ) : (\n \n \n Resolved · Closed\n \n )}\n\n \n Region: us-east-1 (N. Virginia)\n \n
\n\n {/* Title & Description */}\n
\n

{incidentTitle}

\n

\n Adversarial AWS STS role assumption anomaly flagged across external ingress gateways. Compromised\n ephemeral CI/CD workflow token quarantined and revoked in 18 minutes.\n

\n
\n
\n\n {/* Action Buttons */}\n
\n \n {exportNotification ? (\n \n ) : (\n \n )}\n {exportNotification ? 'Exporting PDF...' : 'Export Incident Report PDF'}\n \n\n \n\n \n \n {isResolved ? 'Re-open Incident' : 'Resolve Incident'}\n \n
\n
\n\n \n\n {/* Commander & Forensics Meta Strip */}\n
\n
\n \n \n MV\n \n
\n

Incident Commander

\n

{commanderName}

\n

{commanderRole}

\n
\n
\n\n
\n

Detection Trigger

\n

GuardDuty · IAM.Anomaly.STS

\n

2026-08-21 14:12:08 UTC

\n
\n\n
\n

Threat Vector & Origin

\n

198.51.100.42 (Tor Exit Node)

\n

AS13335 · Ephemeral OIDC Leak

\n
\n\n
\n

Incident War Room

\n
\n \n \n \n \n

#bridge-sec-0842

\n \n 4 Responders\n \n
\n

Bridge active · PagerDuty Sync

\n
\n
\n \n \n\n {/* 2. 4 Incident KPI Telemetry Cards */}\n
\n {/* Card 1: Time to Detect */}\n \n \n
\n

Time to Detect (TTD)

\n
\n \n
\n
\n
\n
4m 12s
\n

\n \n Automated GuardDuty alert fired\n

\n
\n \n \n\n {/* Card 2: Time to Mitigate */}\n \n \n
\n

Time to Mitigate (TTM)

\n
\n \n
\n
\n
\n
18m 45s
\n

\n \n Full perimeter isolation & rotation\n

\n
\n \n \n\n {/* Card 3: Affected Resources */}\n \n \n
\n

Affected Resources

\n
\n \n
\n
\n
\n
3 Gateways
\n

\n apigw-iad-prod-[01..03]\n

\n
\n \n \n\n {/* Card 4: Impacted User Accounts */}\n \n \n
\n

Impacted User Accounts

\n
\n \n
\n
\n
\n
0 Compromised
\n

\n \n 0 compromise confirmed · Token revoked\n

\n
\n \n \n
\n\n {/* 3. Incident Timeline (Vertical Connected Stream) */}\n \n \n
\n
\n Incident Response Timeline\n \n Chronological audit trail of SOC telemetry, containment actions, and mitigation milestones.\n \n
\n
\n \n 5 Timeline Events · UTC Synchronized\n \n
\n
\n \n\n \n
\n {/* Timeline Entry 1: Detection */}\n
\n {/* Node Marker */}\n
\n \n
\n\n {/* Header Row */}\n
\n
\n 2026-08-21T14:12:08Z\n \n 1. Detection\n \n \n T+00:00\n \n

Automated Detection & Anomaly Ingestion

\n
\n\n {/* Investigator Avatar & Name */}\n
\n \n \n MV\n \n Marcus Vance\n (SecOps Lead)\n
\n
\n\n {/* Action Taken Narrative */}\n
\n

Action Taken:

\n

\n AWS GuardDuty anomaly engine flagged an unauthorized STS AssumeRole policy elevation request targeting\n \n role/SuperAdminPolicy\n \n from an unapproved Tor exit node. Ingestion webhook routed alert to PagerDuty SecOps on-call.\n

\n
\n\n {/* System Log Output Snippet Box */}\n
\n
\n
\n \n guardduty_alert_stream.log\n
\n copySnippet('detection')}\n >\n {copiedSnippetId === 'detection' ? (\n \n ) : (\n \n )}\n {copiedSnippetId === 'detection' ? 'Copied' : 'Copy Snippet'}\n \n
\n 
\n                  {logSnippets.detection}\n
\n
\n\n {/* Mitigation Notes Callout */}\n
\n Mitigation Notes: \n \n Perimeter rate-limiting threshold exceeded (52 req/s). SIEM correlated 4 duplicate elevation\n signatures across edge ingress gateways.\n \n
\n
\n\n {/* Timeline Entry 2: Triage */}\n
\n {/* Node Marker */}\n
\n \n
\n\n {/* Header Row */}\n
\n
\n 2026-08-21T14:15:30Z\n \n 2. Triage\n \n \n T+03:22\n \n

SOC Triage & Incident War Room Assembly

\n
\n\n {/* Investigator Avatar & Name */}\n
\n \n \n ER\n \n Elena Rostova\n (Incident Commander)\n
\n
\n\n {/* Action Taken Narrative */}\n
\n

Action Taken:

\n

\n PagerDuty SEV-1 broadcast dispatched. Assembled SecOps, IAM, and Core Infrastructure leads in primary\n war room. Traced origin token{' '}\n tok_88f9x to\n an ephemeral CI/CD GitHub Actions runner.\n

\n
\n\n {/* System Log Output Snippet Box */}\n
\n
\n
\n \n war_room_triage_audit.log\n
\n copySnippet('triage')}\n >\n {copiedSnippetId === 'triage' ? (\n \n ) : (\n \n )}\n {copiedSnippetId === 'triage' ? 'Copied' : 'Copy Snippet'}\n \n
\n 
\n                  {logSnippets.triage}\n
\n
\n\n {/* Mitigation Notes Callout */}\n
\n Mitigation Notes: \n \n Confirmed unauthorized token attempt was using leaked CI/CD ephemeral workflow credential tok_88f9x.\n Scope bounded strictly to read-only API gateway routing.\n \n
\n
\n\n {/* Timeline Entry 3: Containment */}\n
\n {/* Node Marker */}\n
\n \n
\n\n {/* Header Row */}\n
\n
\n 2026-08-21T14:22:15Z\n \n 3. Containment\n \n \n T+10:07\n \n

Perimeter Quarantine & Traffic Blackholing

\n
\n\n {/* Investigator Avatar & Name */}\n
\n \n \n DO\n \n David Okoye\n (Network Security)\n
\n
\n\n {/* Action Taken Narrative */}\n
\n

Action Taken:

\n

\n Cloudflare WAF dynamic block rule enforced for egress IP ASN block (AS13335). Automated session kill\n command dispatched across all 3 production ingress proxy gateway clusters.\n

\n
\n\n {/* System Log Output Snippet Box */}\n
\n
\n
\n \n perimeter_waf_quarantine.log\n
\n copySnippet('containment')}\n >\n {copiedSnippetId === 'containment' ? (\n \n ) : (\n \n )}\n {copiedSnippetId === 'containment' ? 'Copied' : 'Copy Snippet'}\n \n
\n 
\n                  {logSnippets.containment}\n
\n
\n\n {/* Mitigation Notes Callout */}\n
\n Mitigation Notes: \n \n Ingress gateways returned HTTP 403 Forbidden. External traffic from adversarial IP ranges suppressed\n with 0 packet leak into VPC internal mesh.\n \n
\n
\n\n {/* Timeline Entry 4: Token Revocation */}\n
\n {/* Node Marker */}\n
\n \n
\n\n {/* Header Row */}\n
\n
\n 2026-08-21T14:30:53Z\n \n 4. Token Revocation\n \n \n T+18:45\n \n

\n Cryptographic Credential Invalidation & Key Rotation\n

\n
\n\n {/* Investigator Avatar & Name */}\n
\n \n \n JC\n \n Jessica Chen\n (IAM Engineering)\n
\n
\n\n {/* Action Taken Narrative */}\n
\n

Action Taken:

\n

\n Revoked compromised GitHub Actions OIDC token series in AWS IAM & HashiCorp Vault. Rotated parent\n cluster KMS gateway signing keys and flushed authentication verification caches across Redis mesh.\n

\n
\n\n {/* System Log Output Snippet Box */}\n
\n
\n
\n \n vault_revocation_kms_rotation.log\n
\n copySnippet('revocation')}\n >\n {copiedSnippetId === 'revocation' ? (\n \n ) : (\n \n )}\n {copiedSnippetId === 'revocation' ? 'Copied' : 'Copy Snippet'}\n \n
\n 
\n                  {logSnippets.revocation}\n
\n
\n\n {/* Mitigation Notes Callout */}\n
\n Mitigation Notes: \n \n All downstream JWT verification caches invalidated via Redis Pub/Sub broadcast in 84ms. Zero active\n token survivability confirmed.\n \n
\n
\n\n {/* Timeline Entry 5: Post-Mortem Action Items */}\n
\n {/* Node Marker */}\n
\n \n
\n\n {/* Header Row */}\n
\n
\n 2026-08-21T14:48:00Z\n \n 5. Post-Mortem Action Items\n \n \n T+35:52\n \n

\n Threat Vector Neutralized & Post-Mortem Transition\n

\n
\n\n {/* Investigator Avatar & Name */}\n
\n \n \n MV\n \n Marcus Vance\n (SecOps Lead)\n
\n
\n\n {/* Action Taken Narrative */}\n
\n

Action Taken:

\n

\n Completed 15-minute clean traffic audit sweep with 0 anomalous requests. Incident commander officially\n downgraded active SEV-1 to Mitigated status and initiated formal post-mortem action items.\n

\n
\n\n {/* System Log Output Snippet Box */}\n
\n
\n
\n \n post_incident_audit_sweep.log\n
\n copySnippet('postmortem')}\n >\n {copiedSnippetId === 'postmortem' ? (\n \n ) : (\n \n )}\n {copiedSnippetId === 'postmortem' ? 'Copied' : 'Copy Snippet'}\n \n
\n 
\n                  {logSnippets.postmortem}\n
\n
\n\n {/* Mitigation Notes Callout */}\n
\n Mitigation Notes: \n \n Post-incident evidence bundle archived to secure S3 vault bucket{' '}\n \n s3://sec-incidents-2026/0842-audit.tar.gz.enc\n \n . Remediation tasks assigned.\n \n
\n
\n
\n \n \n\n {/* 4. Root Cause & Corrective Action Items Card */}\n \n \n
\n
\n
\n \n Root Cause Analysis & Corrective Action Items\n
\n \n 3 actionable remediation tasks tracked across Jira and GitHub to prevent recurring authorization bypass\n vectors.\n \n
\n \n 3 Post-Mortem Tasks\n \n
\n \n\n \n {/* Root Cause Summary Box */}\n
\n
\n \n Root Cause Summary\n
\n

\n A third-party fork pull request executed via a workflow using{' '}\n pull_request_target{' '}\n allowed unauthorized extraction of the short-lived CI OIDC token. AWS STS role trust policy lacked strict{' '}\n repository_owner and{' '}\n ref claim constraints.\n

\n
\n\n {/* Task List Items */}\n
\n {/* Task 1 */}\n
\n
\n
\n setActionItem1(checked === true)}\n />\n
\n
\n
\n \n SEC-4412\n \n \n P0 Blocker\n \n \n In Review\n \n
\n \n Enforce strict OIDC branch-to-role binding with repository claim validation on CI runner STS\n policies\n

\n

\n Require repository_owner=uipkge and{' '}\n ref=refs/heads/main on all assumed cloud roles.\n

\n
\n
\n\n
\n
\n \n \n JC\n \n Jessica Chen\n
\n \n \n PR #882\n \n
\n
\n\n {/* Task 2 */}\n
\n
\n
\n setActionItem2(checked === true)}\n />\n
\n
\n
\n \n SEC-4413\n \n \n P1 High\n \n \n Completed\n \n
\n \n Reduce default ephemeral CI token TTL from 3600s to 900s across all GitHub Actions deployment\n workflows\n

\n

\n Update HashiCorp Vault AWS secrets engine configuration and OIDC provider default duration.\n

\n
\n
\n\n
\n
\n \n \n DO\n \n David Okoye\n
\n \n Deployed v4.18.2\n \n
\n
\n\n {/* Task 3 */}\n
\n
\n
\n setActionItem3(checked === true)}\n />\n
\n
\n
\n \n SEC-4414\n \n \n P1 High\n \n \n In Progress\n \n
\n \n Implement automated SIEM quarantine webhook to auto-revoke Vault tokens upon GuardDuty high-severity\n finding\n

\n

\n Deploy AWS EventBridge rule to pipe GuardDuty high-severity IAM alerts directly to Lambda quarantine\n webhook.\n

\n
\n
\n\n
\n
\n \n \n MV\n \n Marcus Vance\n
\n \n Sprint 34 · Aug 28\n \n
\n
\n
\n \n \n
\n )\n}\n", "type": "registry:block", "target": "~/components/blocks/SecurityIncidentTimeline.tsx" } ], "dependencies": [ "lucide-react" ], "devDependencies": [], "registryDependencies": [ "https://uipkge.dev/r/react/avatar.json", "https://uipkge.dev/r/react/badge.json", "https://uipkge.dev/r/react/button.json", "https://uipkge.dev/r/react/card.json", "https://uipkge.dev/r/react/checkbox.json", "https://uipkge.dev/r/react/separator.json" ], "description": "Security Operations Center (SOC) incident response timeline and post-mortem tracker with telemetry KPIs, chronological audit trail, log snippets, and corrective action items.", "categories": [ "security", "app", "devops" ] }