The library documents itself · Security & governance
stzIncident
32 own methods · 0 forms written with extensions, listed under their method
the source: base/security/stzIncident.ring(opens in a new tab) · All classes · The area reference: Security & governance
Under each method, its extensions (Q CS XT Z ZZ IB W U): bold and ticked, it exists; struck, it does not. The extensions and what they mean
No method of this class is run on this page: the class reaches files, the network, processes, the clock, chance or sound, and an example run here would only be an example of its effects. Each method carries the explanation the library gives of itself.
Method
Explanation, as the source carries it
init
(no comment in the source: the name reads as a sentence) initno extension
FromCase
building ----------------------------------------------------- Build from a sentinel case (I4) plus the ledger it fired on.no extension
FromFinding
Build from a bare finding (a detection judged outside a sentinel).no extension
WithGraph
Give the incident the security graph, and it can answer HOW far the actor could have reached and WHAT a leaked secret exposes.no extension
Id
readingno extension
Rule
(no comment in the source: the name reads as a sentence) ruleno extension
Where
(no comment in the source: the name reads as a sentence) whereno extension
Severity
(no comment in the source: the name reads as a sentence) severityno extension
Message
(no comment in the source: the name reads as a sentence) messageno extension
Actor
(no comment in the source: the name reads as a sentence) actorno extension
OpenedAt
(no comment in the source: the name reads as a sentence) opened atno extension
HeadDigest
The chain head as it stood when this fired -- compare it with the ledger's later head to know whether history was rewritten.no extension
Events
(no comment in the source: the name reads as a sentence) eventsno extension
NumberOfEvents
(no comment in the source: the name reads as a sentence) number of eventsno extension
Timeline
The story, wall-ordered: [ [ atWall, kind, actor, subject, reason ], ... ]no extension
Actors
(no comment in the source: the name reads as a sentence) actorsno extension
Subjects
(no comment in the source: the name reads as a sentence) subjectsno extension
Kinds
(no comment in the source: the name reads as a sentence) kindsno extension
TraceIds
The trace ids the story touched -- hand one to stzLog.OfTrace() and the handler's own words come back.no extension
SecretsInvolved
The secrets named in the story (descriptors, never values).no extension
AttackPath
what the graph knows ---------------------------------------- How the actor could reach an effectful capability -- the path itself, not merely whether one exists. [] when the graph does not know this actor, or no path exists.no extension
ReachesEffectful
(no comment in the source: the name reads as a sentence) reaches effectfulno extension
BlastRadius
What each implicated secret exposes: [ [ secret, [reachers] ], ... ]no extension
Status
the response (status is forward-only)no extension
IsOpen
(no comment in the source: the name reads as a sentence) is openno extension
IsClosed
(no comment in the source: the name reads as a sentence) is closedno extension
Contain
(no comment in the source: the name reads as a sentence) containno extension
Close
(no comment in the source: the name reads as a sentence) closeno extension
Notes
(no comment in the source: the name reads as a sentence) notesno extension
ToOcsfFindingJson
interop: the incident as an OCSF finding (I7) ---------------- OCSF class 2001, Security Finding -- the class a SIEM expects for "something was concluded", as opposed to the raw events (which the ledger exports separately). The attack path, blast radius and trace ids ride in `unmapped`, which is what that field is for.no extension
Explain
the narrated accountno extension
Show
(no comment in the source: the name reads as a sentence) showno extension