[0b3l1X-SolidGeeks]

Muster side of Strata's incident mode. Strata (the map of the information systems) signs in to Muster with an analyst account, opens linked incidents on its map, runs them from there, and reports back. Strata side: SolidGeeks/strata, PRs for the incident mode and the Muster connection.

What changes

An incident can be linked to Strata. The declare form has a collapsed Link to Strata section: Strata IS id, assets hit (names or Strata ids), and a CVE for {cve} targets. Stored as incident.strata = {site, assets, params, marks, names}, validated by cleanStrata in packages/core/src/strata.ts. Both backends (server and Claude artifact) accept it. The incident list includes strata so Strata can tell which incidents belong to which IS.

Steps say what they act on in Strata. PNode gets two optional fields:

• targets: selectors Strata resolves on its map (affected, compromised, id:<asset>, type:dc, role:backup, vuln:{cve}, exposed:internet, plus reach:, consumers:, flows:, business:, contacts: around another selector).
• effects on a decision: answer → [state, selector]. For example, answering Yes to Exposed assets found? marks the assets carrying the CVE as suspected.

Both are checked by checkGraphShape, so a draft with an unknown selector is refused. They can be edited in the step inspector (Strata targets) and are written to the YAML export. PB-001, PB-003, PB-006 and PB-010 ship with them. Playbooks without them behave as before.

Strata reports back. New route POST /api/incidents/{id}/strata (analyst) takes {site, marks, names, assets, params, log}:

• marks replace the state of the assets.
• log entries land in the timeline as Strata: …, written by the Strata account with the person's name, for example Inès Benali (alice).

The incident page shows a Strata block with the IS, the assets and their state, and what the current step points at.

Report: Assets hit (Strata). The report of a linked incident gets a section listing each asset with its state, on screen, in the PDF and in Markdown. It is left out for incidents that are not linked (reportSections). Templates saved before this section existed get it after Key decisions when read (withAllSections), so the template editor and its "every section" check keep working.

Compatibility

• Playbooks, incidents and templates without the new fields read and run as before. The demo data gains targets on four playbooks.
• No change to authentication: Strata uses the normal session cookie and X-Muster header with a regular analyst account.

Tests

• npm run typecheck: clean.

• npm test: 15 pass. The new API test covers:

  • the shipped targets and effects;
  • declaring with a link, including an invalid IS id;
  • the list summary;
  • /strata (marks, unknown states dropped, viewers refused, log author);
  • a draft with an unknown target refused and a valid one kept;
  • the YAML export;
  • the report section in Markdown and the PDF.

  An existing test now also checks that an unlinked incident's report has no Strata section.

• npm run test:e2e: all checks pass locally. I pointed Playwright at the Chromium already installed in this environment; nothing in the test changed.

• End to end with a real Strata server connected: a ransomware incident run from Strata, with tasks, decisions and flow cuts appearing in Muster's timeline, and a PB-010 decision answered in Muster marking the assets in Strata. Rendered report checked.

---

Generated by Claude Code