incident-room/1.0.0 · updated Jul 9, 2026

Incidents and operations room

How to open, coordinate, and close incidents with tasks, evidence, and a traceable response.

ADDA Incidents turns scattered signals into a coordinated response with owners, tasks, evidence, and visible decisions.

Opening an incident early does not mean dramatizing it. It means organizing context, avoiding duplicate actions, and maintaining an operational history that other teams can resume.

The incident room becomes more valuable when it brings mail, WAF, Access, evidence, reports, tasks, automations, and manual candidates into one work thread.

Checklist

• Open an incident when the situation crosses modules or requires coordination.
• Assign tasks and evidence from the same flow.
• Close with visible status, learnings, and next steps.

Quickstart

1. Open an incident when a finding is no longer an isolated event.
2. Move relevant evidence, tasks, and artifacts into the incident.
3. Use incident closure to leave reusable operational learning.

Operational flow

Open

Define a title, severity, and scope without waiting for perfect context.

Create an early work thread.

Orchestrate

Add tasks, evidence, reports, or automations according to the situation.

Concentrate response and follow-up.

Close and learn

Document the outcome, pending work, and improvements for the manual or product.

Turn response into institutional capability.

flowchart LR
  S1["Open"]
  S2["Orchestrate"]
  S3["Close and learn"]
  S1 --> S2
  S2 --> S3

Validators and checks

They run a contextual reading for this surface and return suggested steps with an operational focus.

Review incident coverage

Operational summary for opening, escalating, and closing a response.

Examples

Payload to open an incident

{
  "title": "Campaña de phishing contra acceso institucional",
  "severity": "red",
  "summary": "Se detectan múltiples correos con dominio imitador y presión sobre login."
}

Links and references

Related routes

Incidents in the workspace SOC

APIs

/api/adda/v1/incidents
/api/adda/v1/incidents/[id]
/api/adda/v1/tasks

Docs and supporting routes

docs/ADDA_SOC_OPERATIVO.md
docs/ADDA_API.md

Common issues

• Responding from multiple views without an incident produces fragmented traces.
• Closing an incident without a manual candidate or learning loses accumulated capability.

Suggested actions

• Promote to an incident when the situation crosses mail, Access, WAF, or evidence.
• Use closure to create residual tasks or manual improvements.

Useful reason codes

Score dictionary

severity

Institutional priority of the signal on the ADDA scale.

action

Next operational step recommended by the engine.

reasonCodes

Explainable reasons that justify the assessment.

Protocol notes

• Incidents organizes coordination; it does not replace each module's technical judgment.

Article history

Jul 9, 2026

New article for the incident room, tasks, and operational learning.