diff --git a/CHANGELOG.md b/CHANGELOG.md
index db0f67a..f5c064b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,12 @@ All notable changes to Muster. Versions follow [Semantic Versioning](https://sem
 
 ## [Unreleased]
 
+### Added
+- **Link to Strata**, the map of the information systems. An incident can be declared with a Strata IS, the assets hit and parameters (a CVE), under **Link to Strata** in the declare form. Strata, signed in with an analyst account, opens it on its map and runs it from there: answers and tasks go both ways. It reports back the state of the assets (compromised, suspected, contained) and what it did, which lands in the timeline as `Strata: …` entries, written by its account with the name of the person on the map. The incident page shows a **Strata** block with the assets and their state, and what the current step points at.
+- **Strata targets on playbook steps**: selectors that say what a step acts on (`affected`, `flows:affected`, `vuln:{cve}`, `role:backup`, `type:dc`, `reach:…`, `consumers:…`, `business:…`, `contacts:…`), edited in the step inspector and checked when a draft is saved, and **effects** on decisions (an answer marks assets in Strata). PB-001, PB-003, PB-006 and PB-010 ship with them. The YAML export writes both.
+- **Assets hit (Strata)** in the incident report (screen, PDF, Markdown): each asset with its state, as Strata last reported it. Shown only for incidents linked to Strata; existing templates get the section after *Key decisions*, and can hide or rename it like the others.
+- API: `strata` on `POST /api/incidents` and in the incident list, and `POST /api/incidents/{id}/strata` (analyst) for what Strata reports back.
+
 ### Changed
 - Built with TypeScript 7 and esbuild 0.28. The app's code is the same; the next image is assembled by the new tools, checked by the browser walk-through and the image test.
 
diff --git a/README.md b/README.md
index a6d22fa..e197c81 100644
--- a/README.md
+++ b/README.md
@@ -87,6 +87,16 @@ gh attestation verify oci://ghcr.io/solidgeeks/muster:1.0.1 --owner SolidGeeks
 
 It must print `Verification succeeded!`. If it fails, do not run the image, and report it (see [SECURITY.md](SECURITY.md)).
 
+## Working with Strata
+
+[Strata](https://github.com/SolidGeeks/strata) maps your information systems. Linked to Muster, a response runs on the map: the assets hit, who to call, the flows to cut, what depends on them.
+
+1. In Muster, create an account for Strata with the **analyst** role (**Admin › Users**).
+2. In Strata, set `MUSTER_URL` (how the Strata server reaches Muster), `MUSTER_USER` and `MUSTER_PASSWORD`.
+3. Declare an incident and open **Link to Strata**: the Strata IS id, the assets hit (names or Strata ids) and, for the *Exploited critical vulnerability* playbook, the CVE.
+
+Strata lists the incident in the incident sheet of that IS. Opened there, it marks the assets, and each step shows what it acts on: the step's **Strata targets** (`affected`, `flows:affected`, `vuln:{cve}`, `role:backup`, `type:dc`, `reach:…`, `consumers:…`, `business:…`, `contacts:…`), set in the editor. Answering a decision in either app moves the response in both; a decision can also mark assets in Strata (`effects`, shipped on PB-003, PB-006 and PB-010). What Strata does (assets marked, flows cut) goes to the timeline, the incident page shows the assets and their state, and the report gets an **Assets hit (Strata)** section (shown only for linked incidents; templates saved before it get it too, and can hide or rename it). A decision answered in Muster marks the assets in Strata as soon as someone allowed to change the incident has that IS open in Strata: nothing is lost in between. The shipped Ransomware, Compromised account, Malware and Exploited critical vulnerability playbooks already carry their targets; the YAML export includes them.
+
 ## How it is built
 
 ```
diff --git a/apps/api/src/repo.ts b/apps/api/src/repo.ts
index 026edb1..53a2b96 100644
--- a/apps/api/src/repo.ts
+++ b/apps/api/src/repo.ts
@@ -2,7 +2,7 @@
 import type { Store } from './db';
 import {
   type Playbook, type PlaybookSummary, type Graph, type Incident, type Report, type Template, type User, type Version,
-  diff, EMPTY_GRAPH, stepCodes, currentStep, incidentTime
+  diff, EMPTY_GRAPH, stepCodes, currentStep, incidentTime, withAllSections
 } from '@muster/core';
 
 /* ---------- Playbooks ---------- */
@@ -78,7 +78,8 @@ export function listIncidents(s: Store) {
       id: inc.id, ref: inc.ref, name: inc.name, pbCode: inc.pbCode, pbName: inc.pbName, v: inc.v, mode: inc.mode, severity: inc.severity,
       status: inc.status, startedAt: inc.startedAt, elapsed, createdBy: inc.createdBy, reportId: inc.reportId || null,
       current: node && inc.status === 'active' ? { code: codes[node.id], title: node.title, role: node.role, overdue: !!(node.sla && stepElapsed > node.sla * 60000) } : null,
-      speed: inc.clock.speed, rev: r.rev
+      speed: inc.clock.speed, rev: r.rev,
+      strata: inc.strata ? { site: inc.strata.site, assets: inc.strata.assets, params: inc.strata.params } : null
     };
   });
 }
@@ -106,12 +107,12 @@ export function listReports(s: Store) {
 /* ---------- Templates ---------- */
 
 export function listTemplates(s: Store): Template[] {
-  return s.all<any>('SELECT data, is_default FROM templates ORDER BY is_default DESC, position, id').map(r => ({ ...JSON.parse(r.data), isDefault: !!r.is_default }));
+  return s.all<any>('SELECT data, is_default FROM templates ORDER BY is_default DESC, position, id').map(r => withAllSections({ ...JSON.parse(r.data), isDefault: !!r.is_default }));
 }
 
 export function getTemplate(s: Store, id: string): Template | undefined {
   const r = s.get<any>('SELECT data, is_default FROM templates WHERE id = ?', id);
-  return r ? { ...JSON.parse(r.data), isDefault: !!r.is_default } : undefined;
+  return r ? withAllSections({ ...JSON.parse(r.data), isDefault: !!r.is_default }) : undefined;
 }
 
 export function defaultTemplate(s: Store): Template {
diff --git a/apps/api/src/routes.ts b/apps/api/src/routes.ts
index 543f615..cc68378 100644
--- a/apps/api/src/routes.ts
+++ b/apps/api/src/routes.ts
@@ -15,7 +15,7 @@ import { renderReportPdf } from '@muster/pdf';
 import {
   type Role, type Graph, type Template, type Report, type Incident, type Severity, type SectionKey,
   uid, clone, validate, checkGraphShape, makeNode, makeEdge, layout, startIncident, advance, toggleTask, stopIncident, setSpeed,
-  reportData, autoSummary, formatId, toMarkdown, toYaml, SEVERITIES, SECTION_LABEL
+  reportData, autoSummary, formatId, toMarkdown, toYaml, SEVERITIES, SECTION_LABEL, cleanStrata, strataLog
 } from '@muster/core';
 
 export interface Config { demo: boolean; secureCookies: boolean }
@@ -229,8 +229,10 @@ export function buildRouter(store: Store, cfg: Config): Router {
     const mode = ctx.body.mode === 'exercise' ? 'exercise' : 'live';
     const speed = mode === 'exercise' ? int(ctx.body.speed ?? 60, 'Speed', 1, 600) : 1;
     const severity = ctx.body.severity ? oneOf(ctx.body.severity, 'Severity', SEVERITIES) : p.severity;
+    let strata;
+    try { strata = cleanStrata(ctx.body.strata); } catch (e) { throw new HttpError(400, (e as Error).message); }
     const inc = store.tx(() => {
-      const i = startIncident({ id: uid('inc_'), ref: incidentRef(store), name, playbookId: p.id, pbCode: p.code, pbName: p.name, v: ver.v, graph: ver.graph, mode, speed, severity, by: u.name });
+      const i = startIncident({ id: uid('inc_'), ref: incidentRef(store), name, playbookId: p.id, pbCode: p.code, pbName: p.name, v: ver.v, graph: ver.graph, mode, speed, severity, by: u.name, strata });
       saveIncident(store, i, true);
       return i;
     });
@@ -270,6 +272,17 @@ export function buildRouter(store: Store, cfg: Config): Router {
     if (inc.status !== 'active') throw new HttpError(422, 'This exercise is over');
     setSpeed(inc, int(ctx.body.speed, 'Speed', 1, 600));
   }));
+  // Strata reports back: the state of the assets on its map (marks), their names, the IS it opened the incident
+  // on, and what it did there (log entries, kept in the timeline and the report)
+  r.post('/api/incidents/:id/strata', ctx => mutate(ctx, (inc, by) => {
+    try { inc.strata = cleanStrata({ site: ctx.body.site, marks: ctx.body.marks, names: ctx.body.names, assets: ctx.body.assets, params: ctx.body.params }, inc.strata); }
+    catch (e) { throw new HttpError(400, (e as Error).message); }
+    const log = Array.isArray(ctx.body.log) ? ctx.body.log.slice(0, 50) : [];
+    for (const l of log) {
+      const msg = str(l?.msg, 'Log entry', 500, { min: 1 });
+      strataLog(inc, msg, (['info', 'ok', 'warn', 'crit', 'dec'] as const).find(k => k === l?.kind) || 'info', typeof l?.by === 'string' && l.by ? `${by} (${l.by.slice(0, 60)})` : by);
+    }
+  }));
   r.post('/api/incidents/:id/stop', ctx => mutate(ctx, (inc, by) => stopIncident(inc, by), 'incident.stop'));
   r.post('/api/incidents/:id/report', ctx => {
     const u = need(ctx, 'analyst');
diff --git a/apps/web/src/backend/artifact.ts b/apps/web/src/backend/artifact.ts
index 9eb278c..c421a28 100644
--- a/apps/web/src/backend/artifact.ts
+++ b/apps/web/src/backend/artifact.ts
@@ -16,7 +16,8 @@
 import {
   type Playbook, type PlaybookSummary, type Incident, type Report, type Template, type Graph, type Severity, type Role, type Version,
   diff, validate, checkGraphShape, makeNode, makeEdge, layout, uid, clone, startIncident, advance as advanceInc, toggleTask, stopIncident,
-  setSpeed, reportData, autoSummary, formatId, toMarkdown, toYaml, defaultPlaybooks, defaultTemplates, currentStep, stepCodes, incidentTime, EMPTY_GRAPH
+  setSpeed, reportData, autoSummary, formatId, toMarkdown, toYaml, defaultPlaybooks, defaultTemplates, currentStep, stepCodes, incidentTime, EMPTY_GRAPH,
+  cleanStrata, withAllSections, type StrataLink
 } from '@muster/core';
 import { renderReportPdf } from '@muster/pdf';
 
@@ -31,7 +32,9 @@ export interface IncidentRow {
   id: string; ref: string; name: string; pbCode: string; pbName: string; v: number; mode: 'live' | 'exercise'; severity: Severity;
   status: Incident['status']; startedAt: number; elapsed: number; createdBy: string; reportId: string | null; speed: number;
   current: { code: string; title: string; role: string; overdue: boolean } | null; rev: number;
+  strata: Pick<StrataLink, 'site' | 'assets' | 'params'> | null;
 }
+export type StrataInput = { site?: string; assets?: string[]; params?: Record<string, string> } | null;
 export interface ReportRow { id: string; num: string; name: string; ref: string; created: string; severity: Severity; author: string; templateId: string; incidentId: string; mode: 'live' | 'exercise' }
 export interface AuditRow { id: number; at: string; user: string; action: string; target: string; detail: string }
 
@@ -204,13 +207,16 @@ async function incidents(): Promise<IncidentRow[]> {
     return {
       id: inc.id, ref: inc.ref, name: inc.name, pbCode: inc.pbCode, pbName: inc.pbName, v: inc.v, mode: inc.mode, severity: inc.severity, status: inc.status,
       startedAt: inc.startedAt, elapsed, createdBy: inc.createdBy, reportId: inc.reportId || null, speed: inc.clock.speed, rev: inc.rev,
-      current: node && inc.status === 'active' ? { code: codes[node.id], title: node.title, role: node.role, overdue: !!(node.sla && stepElapsed > node.sla * 60000) } : null
+      current: node && inc.status === 'active' ? { code: codes[node.id], title: node.title, role: node.role, overdue: !!(node.sla && stepElapsed > node.sla * 60000) } : null,
+      strata: inc.strata ? { site: inc.strata.site, assets: inc.strata.assets, params: inc.strata.params } : null
     };
   });
 }
 async function incident(id: string): Promise<IncidentFull> { return { ...(await incDoc(id)), serverNow: Date.now() }; }
-async function declare(b: { playbookId: string; v: number; name: string; mode: 'live' | 'exercise'; speed: number; severity: Severity }): Promise<IncidentFull> {
+async function declare(b: { playbookId: string; v: number; name: string; mode: 'live' | 'exercise'; speed: number; severity: Severity; strata?: StrataInput }): Promise<IncidentFull> {
   if (!b.name?.trim()) throw new ApiError(400, 'Incident name is required');
+  let strata;
+  try { strata = cleanStrata(b.strata); } catch (e) { throw new ApiError(400, (e as Error).message); }
   const ver = await getDoc(`playbooks/${b.playbookId}/versions/v${b.v}`);
   const p = await pbDoc(b.playbookId);
   if (!ver) throw new ApiError(422, 'Publish this playbook before running it');
@@ -218,7 +224,7 @@ async function declare(b: { playbookId: string; v: number; name: string; mode: '
   const n = await bump('meta/counters', 'incident-' + y, 1);
   const inc = startIncident({
     id: uid('inc_'), ref: `INC-${y}-${String(n).padStart(4, '0')}`, name: b.name.trim().slice(0, 160), playbookId: p.id, pbCode: p.code, pbName: p.name,
-    v: ver.v, graph: ver.graph, mode: b.mode, speed: b.mode === 'exercise' ? Math.min(600, Math.max(1, b.speed || 60)) : 1, severity: b.severity, by: await meId()
+    v: ver.v, graph: ver.graph, mode: b.mode, speed: b.mode === 'exercise' ? Math.min(600, Math.max(1, b.speed || 60)) : 1, severity: b.severity, by: await meId(), strata
   });
   await setDoc(`incidents/${inc.id}`, { ...inc, rev: 1 } as any);
   return incident(inc.id);
@@ -239,8 +245,8 @@ async function mutate(id: string, fn: (inc: Incident, by: string) => void, rev?:
 async function templates(): Promise<Template[]> {
   const [all, seq] = await Promise.all([getAll('templates'), getDoc('meta/seq')]);
   return (all as (Template & { position?: number })[])
-    .map(t => ({ ...t, seq: typeof seq?.[t.id] === 'number' ? seq[t.id] : t.seq }))
-    .sort((a, b) => (Number(b.isDefault) - Number(a.isDefault)) || ((a.position || 0) - (b.position || 0)));
+    .sort((a, b) => (Number(b.isDefault) - Number(a.isDefault)) || ((a.position || 0) - (b.position || 0)))
+    .map(t => withAllSections({ ...t, seq: typeof seq?.[t.id] === 'number' ? seq[t.id] : t.seq }));
 }
 async function setSeq(id: string, value: number) {
   const ref = (await store()).doc('meta/seq');
diff --git a/apps/web/src/backend/http.ts b/apps/web/src/backend/http.ts
index 3a29766..56f2d9a 100644
--- a/apps/web/src/backend/http.ts
+++ b/apps/web/src/backend/http.ts
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import type { Playbook, PlaybookSummary, Incident, Report, Template, User, Graph, Severity, Role } from '@muster/core';
+import type { Playbook, PlaybookSummary, Incident, Report, Template, User, Graph, Severity, Role, StrataLink } from '@muster/core';
 
 export class ApiError extends Error {
   constructor(public status: number, message: string, public data: any = {}) { super(message); }
@@ -29,7 +29,10 @@ export interface IncidentRow {
   id: string; ref: string; name: string; pbCode: string; pbName: string; v: number; mode: 'live' | 'exercise'; severity: Severity;
   status: Incident['status']; startedAt: number; elapsed: number; createdBy: string; reportId: string | null; speed: number;
   current: { code: string; title: string; role: string; overdue: boolean } | null; rev: number;
+  strata: Pick<StrataLink, 'site' | 'assets' | 'params'> | null;
 }
+/** What the declare form sends to link an incident to Strata */
+export type StrataInput = { site?: string; assets?: string[]; params?: Record<string, string> } | null;
 export interface ReportRow { id: string; num: string; name: string; ref: string; created: string; severity: Severity; author: string; templateId: string; incidentId: string; mode: 'live' | 'exercise' }
 export interface AuditRow { id: number; at: string; user: string; action: string; target: string; detail: string }
 
@@ -52,7 +55,7 @@ export const api = {
 
   incidents: () => call<IncidentRow[]>('GET', '/api/incidents'),
   incident: (id: string) => call<IncidentFull>('GET', `/api/incidents/${id}`),
-  declare: (b: { playbookId: string; v: number; name: string; mode: 'live' | 'exercise'; speed: number; severity: Severity }) => call<IncidentFull>('POST', '/api/incidents', b),
+  declare: (b: { playbookId: string; v: number; name: string; mode: 'live' | 'exercise'; speed: number; severity: Severity; strata?: StrataInput }) => call<IncidentFull>('POST', '/api/incidents', b),
   advance: (id: string, edgeId: string, rev: number) => call<IncidentFull>('POST', `/api/incidents/${id}/advance`, { edgeId, rev }),
   task: (id: string, nodeId: string, index: number, done: boolean) => call<IncidentFull>('POST', `/api/incidents/${id}/tasks`, { nodeId, index, done }),
   notes: (id: string, notes: string) => call<IncidentFull>('POST', `/api/incidents/${id}/notes`, { notes }),
diff --git a/apps/web/src/styles.css b/apps/web/src/styles.css
index 3da5d48..fec7dd3 100644
--- a/apps/web/src/styles.css
+++ b/apps/web/src/styles.css
@@ -625,3 +625,13 @@ pre.yaml{margin:0;background:var(--wash);border:1px solid var(--rule);border-rad
 .cp-demo .bar{width:4px;align-self:stretch;border-radius:2px}
 .cp-demo span{font:500 12px var(--f-mono)}
 .cp-demo em{font:650 13px var(--f-ui);font-style:normal;color:#121413}
+
+/* Link to Strata */
+.strata-link{border:1px solid var(--rule);border-radius:4px;padding:8px 12px;margin:4px 0 12px}
+.strata-link summary{cursor:pointer;font-weight:600;font-size:13px}
+.strata-link[open] summary{margin-bottom:8px}
+.strata-b{padding:10px 16px;display:flex;flex-direction:column;gap:8px}
+.strata-assets{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:4px}
+.strata-assets li{display:flex;justify-content:space-between;align-items:center;gap:8px;font-size:13px}
+.strata-assets b{font-family:var(--f-mono,monospace);font-weight:500}
+.strata-link .row2{margin-top:8px}
diff --git a/apps/web/src/views/Editor.tsx b/apps/web/src/views/Editor.tsx
index a8f3897..ccf19a9 100644
--- a/apps/web/src/views/Editor.tsx
+++ b/apps/web/src/views/Editor.tsx
@@ -378,6 +378,13 @@ function Inspector({ pb, setPb, g, sel, setSel, readOnly, val, updateNode, commi
             {!ro && <button className="addrow" onClick={() => { updateNode(n.id, { checklist: [...n.checklist, ''] }, true); setTimeout(() => { const ins = document.querySelectorAll<HTMLInputElement>('.cl input'); ins[ins.length - 1]?.focus(); }, 0); }}>Add task</button>}
           </section>
         )}
+        {!term && (
+          <section className="grp"><div className="grp-h"><h4>Strata targets</h4><span>{plural((n.targets || []).length, 'selector')}</span></div>
+            <label className="field">What this step acts on, one selector per line<textarea className="inp mono" rows={2} disabled={ro} value={(n.targets || []).join('\n')} placeholder={'affected\nflows:affected'}
+              onFocus={snapshot} onChange={e => { const t = e.target.value.split('\n').map(x => x.trim()).filter(Boolean); updateNode(n.id, { targets: t.length ? t : undefined }); }} /></label>
+            <p className="foot">Strata resolves them on its map: affected, compromised, id:&lt;asset&gt;, type:dc, role:backup, vuln:{'{cve}'}, exposed:internet, and reach:, consumers:, flows:, business:, contacts: around another selector.</p>
+          </section>
+        )}
         {n.type !== 'end' && (
           <section className="grp"><div className="grp-h"><h4>{n.type === 'decision' ? 'Answers' : 'Next'}</h4><span>{plural(outs.length, 'route')}</span></div>
             {outs.length ? <div className="outs">{outs.map(e => { const t = g.nodes.find(x => x.id === e.to); return (
diff --git a/apps/web/src/views/IncidentRun.tsx b/apps/web/src/views/IncidentRun.tsx
index f464812..3e00ad8 100644
--- a/apps/web/src/views/IncidentRun.tsx
+++ b/apps/web/src/views/IncidentRun.tsx
@@ -128,6 +128,7 @@ export function IncidentRun({ id }: { id: string }) {
               <ol className="rlog">{inc.log.slice().reverse().map((l, i) => (
                 <li key={i} className={l.kind}><time>{fmtT(l.t)}</time><span className="lv">{LOG_LABEL[l.kind]}</span><span className="msg">{l.msg}{l.by && <span className="by"> · {N(l.by)}</span>}</span></li>))}
               </ol></div>
+            {(inc.strata || n.targets?.length) && <StrataBlock inc={inc} node={done ? null : n} />}
             <Notes inc={inc} readOnly={!canRun} onSaved={apply} />
           </div>
         </div>
@@ -136,6 +137,24 @@ export function IncidentRun({ id }: { id: string }) {
   );
 }
 
+// The incident as Strata sees it: the IS, the assets and their state on the map, what the current step points at
+const STATE_TAG: Record<string, string> = { compromised: 'crit', suspected: 'warn', contained: 'ok' };
+function StrataBlock({ inc, node }: { inc: IncidentFull; node: IncidentFull['graph']['nodes'][number] | null }) {
+  const s = inc.strata, marks = Object.entries(s?.marks || {}), name = (id: string) => s?.names[id] || id;
+  const waiting = s ? s.assets.filter(a => !marks.some(([id]) => id === a || name(id) === a)) : [];
+  return (
+    <div className="blk"><div className="blk-h"><h4>Strata</h4><span className="code">{s?.site ? `IS ${s.site}` : 'not linked'}</span></div>
+      <div className="strata-b">
+        {marks.length > 0 && <ul className="strata-assets">{marks.map(([id, st]) => <li key={id}><b>{name(id)}</b><span className={'tag ' + STATE_TAG[st]}><i />{st}</span></li>)}</ul>}
+        {waiting.length > 0 && <p className="foot">Declared, not yet opened on the map: {waiting.join(', ')}</p>}
+        {s && Object.keys(s.params).length > 0 && <p className="foot">Parameters: {Object.entries(s.params).map(([k, v]) => `${k} = ${v}`).join(' · ')}</p>}
+        {node?.targets?.length ? <p className="foot">This step points Strata at <span className="mono">{node.targets.join(', ')}</span></p> : null}
+        {!s && <p className="foot">Declare the incident with a Strata IS to see it on the map.</p>}
+      </div>
+    </div>
+  );
+}
+
 function Sla({ start, t, sla }: { start: number; t: number; sla: number }) {
   const el = t - start, max = sla * 60000, ratio = el / max;
   return (
diff --git a/apps/web/src/views/Incidents.tsx b/apps/web/src/views/Incidents.tsx
index b54672f..0f9564e 100644
--- a/apps/web/src/views/Incidents.tsx
+++ b/apps/web/src/views/Incidents.tsx
@@ -75,6 +75,9 @@ export function DeclareModal({ playbookId, onClose }: { playbookId?: string; onC
   const [severity, setSeverity] = useState<Severity>('High');
   const [mode, setMode] = useState<'live' | 'exercise'>('live');
   const [speed, setSpeed] = useState(60);
+  const [site, setSite] = useState('');
+  const [assets, setAssets] = useState('');
+  const [cve, setCve] = useState('');
   const [busy, setBusy] = useState(false);
   const [err, setErr] = useState<string | null>(null);
   const published = (list.data || []).filter(p => p.liveVersion);
@@ -90,7 +93,9 @@ export function DeclareModal({ playbookId, onClose }: { playbookId?: string; onC
   const submit = async () => {
     setBusy(true); setErr(null);
     try {
-      const inc = await api.declare({ playbookId: pid, v, name: name.trim(), mode, speed, severity });
+      const list = assets.split(/[,\n]/).map(s => s.trim()).filter(Boolean);
+      const strata = site.trim() || list.length || cve.trim() ? { site: site.trim(), assets: list, params: (cve.trim() ? { cve: cve.trim() } : {}) as Record<string, string> } : null;
+      const inc = await api.declare({ playbookId: pid, v, name: name.trim(), mode, speed, severity, strata });
       toast(`${inc.ref} declared`);
       go(`incidents/${inc.id}`);
     } catch (e) { setErr((e as Error).message); setBusy(false); }
@@ -119,6 +124,15 @@ export function DeclareModal({ playbookId, onClose }: { playbookId?: string; onC
           <label className="field">Clock speed<select className="inp" value={speed} onChange={e => setSpeed(Number(e.target.value))}>{[1, 10, 60, 300].map(s => <option key={s} value={s}>×{s}{s === 60 ? ' (one minute per second)' : ''}</option>)}</select></label>
         ) : <div className="field">Clock<div className="inp" style={{ display: 'flex', alignItems: 'center', color: 'var(--muted)' }}>Real time</div></div>}
       </div>
+      <details className="strata-link">
+        <summary>Link to Strata (optional)</summary>
+        <p className="foot">Strata opens the incident on its map: the assets you name are marked compromised, and each playbook step points at the assets, flows and contacts it acts on.</p>
+        <div className="row2">
+          <label className="field">Strata IS id<input className="inp" value={site} onChange={e => setSite(e.target.value)} placeholder="e.g. lyon" /></label>
+          <label className="field">Vulnerability (for {'{cve}'} targets)<input className="inp" value={cve} onChange={e => setCve(e.target.value)} placeholder="e.g. CVE-2024-21887" /></label>
+        </div>
+        <label className="field">Assets hit, by name or Strata id, comma-separated<input className="inp" value={assets} onChange={e => setAssets(e.target.value)} placeholder="e.g. file-01, pc-acct-01" /></label>
+      </details>
       <div className="static-wrap" style={{ height: 220, borderRadius: 4, border: '1px solid var(--rule)' }}>
         {ver ? <StaticGraph g={ver.graph} label="Playbook preview" /> : <Loading label="Loading preview" />}
       </div>
diff --git a/apps/web/src/views/Sheet.tsx b/apps/web/src/views/Sheet.tsx
index 1ca38c4..b425b84 100644
--- a/apps/web/src/views/Sheet.tsx
+++ b/apps/web/src/views/Sheet.tsx
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import type { ReactElement } from 'react';
 import type { Report, Template } from '@muster/core';
-import { fmtDur, fmtLong, fmtSla, fmtHM, fmtT, LOG_LABEL, reportStatusLabel } from '@muster/core';
+import { fmtDur, fmtLong, fmtSla, fmtHM, fmtT, LOG_LABEL, reportStatusLabel, reportSections } from '@muster/core';
 import { useNames } from '../lib';
 
 const safeAcc = (c: string) => (/^#[0-9a-f]{6}$/i.test(c || '') ? c : '#121413');
@@ -26,6 +26,11 @@ export function Sheet({ t, r }: { t: Template; r: Report }) {
       {withSla.length > 0 && <p className="rp-note">{met} of {withSla.length} SLAs met.</p>}
     </>) : <p className="rp-empty">No steps were completed.</p>,
     decisions: () => d.decisions.length ? <div className="rp-dec">{d.decisions.map((x, i) => <div key={i}><span>{x.q}</span><b>{x.a}</b><small>Led to {x.to}</small></div>)}</div> : <p className="rp-empty">No decisions recorded.</p>,
+    assets: () => d.strata?.assets.length ? (<>
+      <div className="tablewrap"><table className="rp-t"><thead><tr><th>Asset</th><th className="r">State</th></tr></thead>
+        <tbody>{d.strata.assets.map(a => <tr key={a.id}><td className="m">{a.name}</td><td className="r">{a.state === 'contained' ? <span className="st-ok">Contained</span> : <span className="st-br">{a.state === 'compromised' ? 'Compromised' : 'Suspected'}</span>}</td></tr>)}</tbody></table></div>
+      <p className="rp-note">Reported by Strata, IS {d.strata.site || '—'}.</p>
+    </>) : <p className="rp-empty">No asset marked on the map.</p>,
     notes: () => r.notes ? <Paras className="rp-body" text={r.notes} /> : <p className="rp-empty">No analyst notes.</p>,
     signoff: () => <div className="rp-sign">{[['Prepared by', N(r.author)], ['Reviewed by', ''], ['Approved by', '']].map(([k, v]) => <div key={k}><small>{k}</small><b>{v || ' '}</b><i /><small>Date</small></div>)}</div>
   };
@@ -43,7 +48,7 @@ export function Sheet({ t, r }: { t: Template; r: Report }) {
       <h1>{d.name}</h1>
       <div className="rp-sub">Incident report · {d.ref}{d.mode === 'exercise' ? ' (exercise)' : ''} · {d.pbCode} {d.pbName} v{d.v}</div>
       <div className="rp-meta">{meta.map(([k, v]) => <div key={k}><small>{k}</small><b>{v}</b></div>)}</div>
-      {t.sections.filter(s => s.on).map((s, i) => (
+      {reportSections(t, d).map((s, i) => (
         <section className="rp-sec" key={s.key}><h2><span>{String(i + 1).padStart(2, '0')}</span>{s.title}</h2>{sections[s.key]()}</section>
       ))}
       <div className="rp-foot"><span>{t.footer}</span><span className="m">{r.num}</span></div>
diff --git a/packages/core/src/graph.ts b/packages/core/src/graph.ts
index 41289f5..9e2f7e0 100644
--- a/packages/core/src/graph.ts
+++ b/packages/core/src/graph.ts
@@ -1,4 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
+import { checkTargets } from './strata';
 import type { Graph, PNode, PEdge, NodeType } from './types';
 
 export const NODE_W = 220;
@@ -198,6 +199,8 @@ export function checkGraphShape(g: unknown): string | null {
     if (!Array.isArray(n.checklist) || n.checklist.some(c => typeof c !== 'string' || c.length > 500)) return `Invalid checklist on ${n.id}`;
     if (typeof n.sla !== 'number' || n.sla < 0 || n.sla > 525600) return `Invalid SLA on ${n.id}`;
     for (const k of ['phase', 'role', 'desc'] as const) if (typeof n[k] !== 'string' || n[k].length > 4000) return `Invalid ${k} on ${n.id}`;
+    const t = checkTargets(n);
+    if (t) return t;
   }
   const eids = new Set<string>();
   for (const e of gr.edges) {
diff --git a/packages/core/src/incident.ts b/packages/core/src/incident.ts
index d5835e1..e958176 100644
--- a/packages/core/src/incident.ts
+++ b/packages/core/src/incident.ts
@@ -27,7 +27,7 @@ function log(inc: Incident, t: number, msg: string, kind: LogKind, by?: string)
 /** Create an incident on a frozen playbook version and move past Start. */
 export function startIncident(params: {
   id: string; ref: string; name: string; playbookId: string; pbCode: string; pbName: string; v: number; graph: Graph;
-  mode: 'live' | 'exercise'; speed: number; severity: Incident['severity']; by: string; now?: number;
+  mode: 'live' | 'exercise'; speed: number; severity: Incident['severity']; by: string; now?: number; strata?: Incident['strata'];
 }): Incident {
   const now = params.now ?? Date.now();
   const st = params.graph.nodes.find(n => n.type === 'start');
@@ -36,7 +36,8 @@ export function startIncident(params: {
     id: params.id, ref: params.ref, name: params.name, playbookId: params.playbookId, pbCode: params.pbCode, pbName: params.pbName,
     v: params.v, graph: params.graph, mode: params.mode, severity: params.severity, status: 'active', startedAt: now,
     clock: { base: 0, anchor: now, speed: params.mode === 'exercise' ? params.speed : 1 },
-    steps: [{ id: st.id, start: 0 }], checks: {}, log: [], notes: '', reportId: null, createdBy: params.by
+    steps: [{ id: st.id, start: 0 }], checks: {}, log: [], notes: '', reportId: null, createdBy: params.by,
+    ...(params.strata ? { strata: params.strata } : {})
   };
   log(inc, 0, `${params.mode === 'exercise' ? 'Exercise' : 'Incident'} declared on ${params.pbName} v${params.v}`, 'info', params.by);
   const first = params.graph.edges.find(e => e.from === st.id);
@@ -110,6 +111,8 @@ export function simulateIncident(inc: Incident, choices: Record<string, string>,
   return inc;
 }
 
+const STATE_ORDER = ['compromised', 'suspected', 'contained'];
+
 export function reportData(inc: Incident, now = Date.now()): ReportData {
   const g = inc.graph, f = (id: string) => g.nodes.find(x => x.id === id), codes = stepCodes(g);
   const steps = inc.steps
@@ -125,7 +128,8 @@ export function reportData(inc: Incident, now = Date.now()): ReportData {
   return {
     ref: inc.ref, name: inc.name, pbCode: inc.pbCode, pbName: inc.pbName, v: inc.v, mode: inc.mode, startedAt: inc.startedAt,
     duration: inc.status === 'active' ? clockNow(inc.clock, now) : (inc.endedAt ?? 0), status: inc.status,
-    steps, decisions, timeline: inc.log.map(l => ({ ...l })), notes: inc.notes || ''
+    steps, decisions, timeline: inc.log.map(l => ({ ...l })), notes: inc.notes || '',
+    ...(inc.strata ? { strata: { site: inc.strata.site, assets: Object.entries(inc.strata.marks).map(([id, state]) => ({ id, name: inc.strata!.names[id] || id, state })).sort((a, b) => STATE_ORDER.indexOf(a.state) - STATE_ORDER.indexOf(b.state) || a.name.localeCompare(b.name)) } } : {})
   };
 }
 
@@ -155,8 +159,19 @@ export function formatId(tpl: Pick<Template, 'pattern' | 'pad'>, date: number |
 }
 
 export const SECTION_LABEL: Record<TemplateSection['key'], string> = {
-  summary: 'Executive summary', timeline: 'Timeline', sla: 'SLA performance', decisions: 'Key decisions', notes: 'Analyst notes', signoff: 'Sign-off'
+  summary: 'Executive summary', timeline: 'Timeline', sla: 'SLA performance', decisions: 'Key decisions', assets: 'Assets hit (Strata)', notes: 'Analyst notes', signoff: 'Sign-off'
 };
+/** A template with every section: one saved before a section existed gets it, shown, after the section it follows by default. */
+export function withAllSections(t: Template): Template {
+  const keys = Object.keys(SECTION_LABEL) as TemplateSection['key'][];
+  const s = [...(t.sections || [])];
+  keys.forEach((k, i) => { if (!s.some(x => x.key === k)) { const prev = keys.slice(0, i).reverse().map(p => s.findIndex(x => x.key === p)).find(j => j >= 0) ?? -1; s.splice(prev + 1, 0, { key: k, title: SECTION_LABEL[k], on: true }); } });
+  return { ...t, sections: s };
+}
+/** The sections a report shows: those switched on, without the Strata section for an incident not linked to Strata. */
+export function reportSections(t: Template, d: ReportData): TemplateSection[] {
+  return withAllSections(t).sections.filter(s => s.on && (s.key !== 'assets' || !!d.strata));
+}
 
 export function defaultTemplates(): Template[] {
   const mk = (a: [TemplateSection['key'], string, boolean][]) => a.map(([key, title, on]) => ({ key, title, on }));
@@ -165,13 +180,13 @@ export function defaultTemplates(): Template[] {
       id: 'tpl-std', name: 'Standard incident report', org: 'Northwind Group', logo: null, pattern: 'IR-{YYYY}-{SEQ}', seq: 42, pad: 3,
       classification: 'Confidential', accent: '#FF5A1F', isDefault: true,
       footer: 'Prepared by Northwind Security Operations. Do not forward outside the organisation.',
-      sections: mk([['summary', 'Executive summary', true], ['timeline', 'Timeline', true], ['sla', 'SLA performance', true], ['decisions', 'Key decisions', true], ['notes', 'Analyst notes', true], ['signoff', 'Sign-off', true]])
+      sections: mk([['summary', 'Executive summary', true], ['timeline', 'Timeline', true], ['sla', 'SLA performance', true], ['decisions', 'Key decisions', true], ['assets', 'Assets hit (Strata)', true], ['notes', 'Analyst notes', true], ['signoff', 'Sign-off', true]])
     },
     {
       id: 'tpl-reg', name: 'Regulator brief', org: 'Northwind Group', logo: null, pattern: '{PB}-REG-{YYMMDD}-{SEQ}', seq: 1, pad: 2,
       classification: 'Restricted · Legal review', accent: '#121413', isDefault: false,
       footer: 'Prepared for notification to the supervisory authority. Legal reviews it before submission.',
-      sections: mk([['summary', 'Summary of the breach', true], ['decisions', 'Containment decisions', true], ['timeline', 'Chronology', true], ['sla', 'Response times', false], ['notes', 'Analyst notes', false], ['signoff', 'Approval', true]])
+      sections: mk([['summary', 'Summary of the breach', true], ['decisions', 'Containment decisions', true], ['assets', 'Systems affected', true], ['timeline', 'Chronology', true], ['sla', 'Response times', false], ['notes', 'Analyst notes', false], ['signoff', 'Approval', true]])
     }
   ];
 }
@@ -190,13 +205,14 @@ export function toMarkdown(t: Template, r: Report): string {
   let m = `# ${oneLine(r.num)} — ${oneLine(d.name)}\n\n${oneLine(t.org)}${t.classification ? ' · ' + oneLine(t.classification) : ''}\n\n| Field | Value |\n|---|---|\n` +
     `| Incident | ${cell(d.ref)}${d.mode === 'exercise' ? ' (exercise)' : ''} |\n| Playbook | ${cell(d.pbCode)} ${cell(d.pbName)} v${cell(d.v)} |\n| Severity | ${cell(r.severity)} |\n| Status | ${reportStatusLabel(d.status)} |\n` +
     `| Declared | ${fmtLong(d.startedAt)} |\n| Duration | ${fmtDur(d.duration)} |\n| SLAs met | ${withSla.length ? met + ' / ' + withSla.length : '—'} |\n| Author | ${cell(r.author)} |\n\n`;
-  t.sections.filter(s => s.on).forEach((s, i) => {
+  reportSections(t, d).forEach((s, i) => {
     m += `## ${String(i + 1).padStart(2, '0')} ${oneLine(s.title)}\n\n`;
     if (s.key === 'summary') m += (r.summary || '') + '\n\n';
     else if (s.key === 'notes') m += (r.notes || '_No analyst notes._') + '\n\n';
     else if (s.key === 'timeline') m += '| UTC | T+ | Type | Event |\n|---|---|---|---|\n' + d.timeline.map(l => `| ${fmtHM(d.startedAt + l.t)} | ${fmtT(l.t).slice(2)} | ${LOG_LABEL[l.kind] || ''} | ${cell(l.msg)} |`).join('\n') + '\n\n';
     else if (s.key === 'sla') m += '| Step | Owner | Target | Actual | Status |\n|---|---|---|---|---|\n' + d.steps.map(x => `| ${cell(x.code)} ${cell(x.title)} | ${x.role ? cell(x.role) : '—'} | ${x.sla ? fmtSla(x.sla) : '—'} | ${fmtDur(x.dur)} | ${!x.sla ? '—' : x.breach ? 'Breached' : 'Met'} |`).join('\n') + '\n\n';
     else if (s.key === 'decisions') m += (d.decisions.map(x => `- **${oneLine(x.q)}** ${oneLine(x.a)}, then ${oneLine(x.to)}`).join('\n') || '_No decisions recorded._') + '\n\n';
+    else if (s.key === 'assets') m += (d.strata!.assets.length ? '| Asset | State |\n|---|---|\n' + d.strata!.assets.map(a => `| ${cell(a.name)} | ${a.state} |`).join('\n') : '_No asset marked on the map._') + `\n\nStrata IS: ${oneLine(d.strata!.site || '—')}\n\n`;
     else if (s.key === 'signoff') m += `- Prepared by: ${oneLine(r.author)}\n- Reviewed by:\n- Approved by:\n\n`;
   });
   return m + `---\n\n${t.footer}\n`;
@@ -212,6 +228,8 @@ export function toYaml(p: { code: string; name: string; category?: string }, g:
     if (n.sla) y += `    sla_minutes: ${n.sla}\n`;
     if (n.desc) y += `    instructions: ${q(n.desc)}\n`;
     if (n.checklist.length) y += `    checklist:\n` + n.checklist.map(c => `      - ${q(c)}\n`).join('');
+    if (n.targets?.length) y += `    targets: [${n.targets.map(q).join(', ')}]\n`;
+    if (n.effects && Object.keys(n.effects).length) y += `    effects:\n` + Object.entries(n.effects).map(([k, [st, sel]]) => `      ${q(k)}: [${st}, ${q(sel)}]\n`).join('');
     const o = g.edges.filter(e => e.from === n.id);
     if (o.length) y += `    next:\n` + o.map(e => `      - to: ${e.to}` + (e.label ? `\n        when: ${q(e.label)}` : '') + '\n').join('');
   }
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index d75fe5e..f56d922 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -4,3 +4,4 @@ export * from './format';
 export * from './graph';
 export * from './incident';
 export * from './playbooks';
+export * from './strata';
diff --git a/packages/core/src/playbooks.ts b/packages/core/src/playbooks.ts
index 0eb7229..4a4f4ab 100644
--- a/packages/core/src/playbooks.ts
+++ b/packages/core/src/playbooks.ts
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
-import type { Graph, NodeType, Severity } from './types';
+import type { Graph, NodeType, PNode, Severity } from './types';
 import { layout, makeNode, makeEdge, clone } from './graph';
 
 type StepDef = [id: string, type: NodeType, title: string, phase: string, role?: string, sla?: number, desc?: string, checklist?: string[]];
@@ -24,9 +24,27 @@ export interface SeedPlaybook {
 
 const D = 'Lessons learned';
 
+// What each step acts on in Strata, when the incident is linked to its map (see strata.ts)
+type Aim = Record<string, { targets?: string[]; effects?: PNode['effects'] }>;
+function aim(g: Graph, a: Aim): Graph {
+  g.nodes.forEach(n => { const x = a[n.id]; if (x?.targets) n.targets = x.targets; if (x?.effects) n.effects = x.effects; });
+  return g;
+}
+const RANSOMWARE_AIM: Aim = {
+  triage: { targets: ['affected', 'contacts:affected'] },
+  encrypt: { targets: ['compromised'] },
+  isolate: { targets: ['affected', 'flows:affected'] },
+  crisis: { targets: ['business:affected', 'contacts:is'] },
+  forensic: { targets: ['affected', 'reach:affected'] },
+  backup: { targets: ['role:backup', 'flows:role:backup'] },
+  restore: { targets: ['compromised', 'consumers:compromised'] },
+  rebuild: { targets: ['compromised', 'type:dc'] },
+  watch: { targets: ['affected', 'role:SIEM'] }
+};
+
 /* 1 — Ransomware: ships with three versions and an unpublished change, to show history and diffs. */
 function ransomware(): SeedPlaybook {
-  const v3 = build([
+  const v3 = aim(build([
     ['start', 'start', 'Alert received', 'Detection'],
     ['triage', 'action', 'Triage the alert', 'Detection', 'L1 Analyst', 15, 'Confirm ransomware activity and rule out a false positive before anyone escalates.', ['Check the alert source (EDR, SIEM, user report)', 'List affected hosts and accounts', 'Open the incident ticket']],
     ['encrypt', 'decision', 'Encryption in progress?', 'Detection', 'L1 Analyst', 5, 'Are files being encrypted or mass-renamed right now?'],
@@ -39,7 +57,7 @@ function ransomware(): SeedPlaybook {
     ['watch', 'action', 'Heightened monitoring', 'Detection', 'L1 Analyst', 60, 'No encryption observed. Monitor closely and document.', ['Create a detection rule for the IOCs', 'Watch the hosts for 24 h']],
     ['review', 'action', 'Post-incident review', D, 'IR Lead', 120, '', ['Write the timeline', 'List corrective actions', 'Update this playbook']],
     ['end', 'end', 'Incident closed', D]
-  ], [['start', 'triage'], ['triage', 'encrypt'], ['encrypt', 'isolate', 'Yes'], ['encrypt', 'watch', 'No'], ['isolate', 'crisis'], ['crisis', 'forensic'], ['forensic', 'backup'], ['backup', 'restore', 'Yes'], ['backup', 'rebuild', 'No'], ['restore', 'review'], ['rebuild', 'review'], ['watch', 'review'], ['review', 'end']]);
+  ], [['start', 'triage'], ['triage', 'encrypt'], ['encrypt', 'isolate', 'Yes'], ['encrypt', 'watch', 'No'], ['isolate', 'crisis'], ['crisis', 'forensic'], ['forensic', 'backup'], ['backup', 'restore', 'Yes'], ['backup', 'rebuild', 'No'], ['restore', 'review'], ['rebuild', 'review'], ['watch', 'review'], ['review', 'end']]), RANSOMWARE_AIM);
   const v2 = clone(v3);
   v2.nodes.find(n => n.id === 'crisis')!.checklist.pop();
   v2.nodes.find(n => n.id === 'review')!.checklist.pop();
@@ -92,7 +110,7 @@ function one(code: string, name: string, category: string, severity: Severity, d
 
 const accountCompromise = () => one('PB-003', 'Compromised account', 'Identity', 'High',
   'Suspicious sign-in or confirmed takeover of a user account. Cut access, scope what the attacker did, restore safely.',
-  '2026-04-02T09:00:00Z', 'Camille R.', build([
+  '2026-04-02T09:00:00Z', 'Camille R.', aim(build([
     ['start', 'start', 'Suspicious sign-in alert', 'Detection'],
     ['triage', 'action', 'Review the sign-in', 'Detection', 'L1 Analyst', 15, 'Look at location, device, client and MFA events around the alert.', ['Check impossible travel and unfamiliar devices', 'Review MFA prompts and approvals', 'Confirm with the user by phone, not email']],
     ['confirmed', 'decision', 'Compromise confirmed?', 'Detection', 'L1 Analyst', 10],
@@ -104,7 +122,7 @@ const accountCompromise = () => one('PB-003', 'Compromised account', 'Identity',
     ['restore', 'action', 'Restore and monitor', 'Recovery', 'L2 Analyst', 60, '', ['Re-enable with new credentials and MFA', 'Add a 14-day monitoring rule', 'Brief the user']],
     ['review', 'action', 'Post-incident review', D, 'IR Lead', 60, '', ['Record the root cause', 'List corrective actions']],
     ['end', 'end', 'Incident closed', D]
-  ], [['start', 'triage'], ['triage', 'confirmed'], ['confirmed', 'contain', 'Yes'], ['confirmed', 'fp', 'No'], ['fp', 'end'], ['contain', 'scope'], ['scope', 'priv'], ['priv', 'escalate', 'Yes'], ['priv', 'restore', 'No'], ['escalate', 'restore'], ['restore', 'review'], ['review', 'end']]));
+  ], [['start', 'triage'], ['triage', 'confirmed'], ['confirmed', 'contain', 'Yes'], ['confirmed', 'fp', 'No'], ['fp', 'end'], ['contain', 'scope'], ['scope', 'priv'], ['priv', 'escalate', 'Yes'], ['priv', 'restore', 'No'], ['escalate', 'restore'], ['restore', 'review'], ['review', 'end']]), { triage: { targets: ['affected', 'contacts:affected'] }, confirmed: { targets: ['suspected'], effects: { Yes: ['compromised', 'suspected'] } }, contain: { targets: ['compromised', 'flows:compromised'] }, scope: { targets: ['compromised', 'reach:compromised'] }, escalate: { targets: ['business:affected', 'contacts:is'] }, restore: { targets: ['compromised'] } }));
 
 const ceoFraud = () => one('PB-004', 'CEO fraud and payment diversion', 'Fraud', 'High',
   'Urgent payment request or changed bank details from a fake executive or supplier. Stop the money first.',
@@ -139,7 +157,7 @@ const dataBreach = () => one('PB-005', 'Personal data breach', 'Data protection'
 
 const malware = () => one('PB-006', 'Malware on an endpoint', 'Malware', 'Medium',
   'EDR or antivirus alert on a workstation or server. Check execution, contain, hunt for spread.',
-  '2026-03-28T08:30:00Z', 'Noah L.', build([
+  '2026-03-28T08:30:00Z', 'Noah L.', aim(build([
     ['start', 'start', 'EDR malware alert', 'Detection'],
     ['triage', 'action', 'Triage the detection', 'Detection', 'L1 Analyst', 15, '', ['Check the file hash reputation', 'Identify the user and host', 'Check whether the EDR blocked it']],
     ['ran', 'decision', 'Did the malware run?', 'Detection', 'L1 Analyst', 10],
@@ -152,7 +170,7 @@ const malware = () => one('PB-006', 'Malware on an endpoint', 'Malware', 'Medium
     ['reimage', 'action', 'Reimage affected hosts', 'Recovery', 'IT support', 240, '', ['Back up user data', 'Reimage from the standard image', 'Reset user credentials']],
     ['review', 'action', 'Post-incident review', D, 'IR Lead', 60, '', ['Identify the delivery vector', 'List corrective actions']],
     ['end', 'end', 'Incident closed', D]
-  ], [['start', 'triage'], ['triage', 'ran'], ['ran', 'isolate', 'Yes'], ['ran', 'clean', 'No'], ['clean', 'end'], ['isolate', 'analyse'], ['analyse', 'hunt'], ['hunt', 'spread'], ['spread', 'escalate', 'Yes'], ['spread', 'reimage', 'No'], ['escalate', 'reimage'], ['reimage', 'review'], ['review', 'end']]));
+  ], [['start', 'triage'], ['triage', 'ran'], ['ran', 'isolate', 'Yes'], ['ran', 'clean', 'No'], ['clean', 'end'], ['isolate', 'analyse'], ['analyse', 'hunt'], ['hunt', 'spread'], ['spread', 'escalate', 'Yes'], ['spread', 'reimage', 'No'], ['escalate', 'reimage'], ['reimage', 'review'], ['review', 'end']]), { triage: { targets: ['affected', 'contacts:affected'] }, ran: { targets: ['suspected'], effects: { Yes: ['compromised', 'suspected'] } }, isolate: { targets: ['compromised', 'flows:compromised'] }, analyse: { targets: ['compromised'] }, hunt: { targets: ['reach:compromised'] }, spread: { targets: ['reach:compromised'] }, escalate: { targets: ['business:affected', 'contacts:is'] }, reimage: { targets: ['compromised', 'consumers:compromised'] } }));
 
 const ddos = () => one('PB-007', 'DDoS attack', 'Availability', 'High',
   'A public service slows down or goes offline under abnormal traffic. Confirm, mitigate upstream, keep customers informed.',
@@ -199,7 +217,7 @@ const insider = () => one('PB-009', 'Insider threat', 'Insider', 'High',
 
 const vuln = () => one('PB-010', 'Exploited critical vulnerability', 'Vulnerability', 'Critical',
   'A critical flaw in a product you run is exploited in the wild. Find exposure, mitigate, hunt for compromise.',
-  '2026-08-21T07:45:00Z', 'Noah L.', build([
+  '2026-08-21T07:45:00Z', 'Noah L.', aim(build([
     ['start', 'start', 'Critical vulnerability exploited', 'Detection'],
     ['exposure', 'action', 'Identify exposed assets', 'Detection', 'L2 Analyst', 60, '', ['Match the affected product and versions', 'Check internet exposure', 'List system owners']],
     ['found', 'decision', 'Exposed assets found?', 'Detection', 'L2 Analyst', 10],
@@ -210,7 +228,7 @@ const vuln = () => one('PB-010', 'Exploited critical vulnerability', 'Vulnerabil
     ['major', 'escalation', 'Open a major incident', 'Eradication', 'IR Lead', 30, '', ['Start the intrusion or ransomware playbook', 'Preserve evidence']],
     ['review', 'action', 'Post-incident review', D, 'IR Lead', 60, '', ['Measure time to patch', 'Review asset inventory gaps']],
     ['end', 'end', 'Incident closed', D]
-  ], [['start', 'exposure'], ['exposure', 'found'], ['found', 'mitigate', 'Yes'], ['found', 'doc', 'No'], ['doc', 'end'], ['mitigate', 'hunt'], ['hunt', 'comp'], ['comp', 'major', 'Yes'], ['comp', 'review', 'No'], ['major', 'review'], ['review', 'end']]));
+  ], [['start', 'exposure'], ['exposure', 'found'], ['found', 'mitigate', 'Yes'], ['found', 'doc', 'No'], ['doc', 'end'], ['mitigate', 'hunt'], ['hunt', 'comp'], ['comp', 'major', 'Yes'], ['comp', 'review', 'No'], ['major', 'review'], ['review', 'end']]), { exposure: { targets: ['vuln:{cve}', 'contacts:vuln:{cve}'] }, found: { targets: ['vuln:{cve}'], effects: { Yes: ['suspected', 'vuln:{cve}'] } }, mitigate: { targets: ['vuln:{cve}', 'flows:vuln:{cve}'] }, hunt: { targets: ['vuln:{cve}', 'reach:vuln:{cve}'] }, comp: { targets: ['vuln:{cve}'], effects: { Yes: ['compromised', 'vuln:{cve}'] } }, major: { targets: ['business:affected', 'contacts:affected'] } }));
 
 export function defaultPlaybooks(): SeedPlaybook[] {
   return [ransomware(), phishing(), accountCompromise(), ceoFraud(), dataBreach(), malware(), ddos(), lostDevice(), insider(), vuln()];
diff --git a/packages/core/src/strata.ts b/packages/core/src/strata.ts
new file mode 100644
index 0000000..7483f96
--- /dev/null
+++ b/packages/core/src/strata.ts
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Link to Strata, the map of the information systems. An incident can name a Strata IS, the assets it starts
+// from and parameters (a CVE…); Strata opens it on its map, runs the playbook there and reports back the state of
+// the assets and what it did. A playbook step names what it acts on through `targets` selectors, which Strata
+// resolves on its map; a decision can mark assets through `effects`.
+import type { PNode, StrataLink, StrataState, Incident, LogKind } from './types';
+import { clockNow } from './incident';
+
+export const STRATA_STATES: StrataState[] = ['compromised', 'suspected', 'contained'];
+// affected, compromised, id:<asset>, type:<type>, role:<text>, vuln:<CVE or {param}>, exposed:internet,
+// reach:<selector>, consumers:<selector>, flows:<selector>, business:<selector>, contacts:<selector>, contacts:is
+const BASE = /^(affected|compromised|suspected|contained|exposed:internet|contacts:is|(id|type|role|vuln):[^\n]{1,120})$/;
+const WRAP = /^(reach|consumers|flows|business|contacts):(.+)$/;
+export function isSelector(s: unknown): boolean {
+  if (typeof s !== 'string' || s.length > 160) return false;
+  if (BASE.test(s)) return true;
+  const m = WRAP.exec(s);
+  return !!m && isSelector(m[2]);
+}
+/** An error message for the targets and effects of a step, or null when they are fine (both are optional). */
+export function checkTargets(n: PNode): string | null {
+  if (n.targets !== undefined) {
+    if (!Array.isArray(n.targets) || n.targets.length > 12) return `Invalid targets on ${n.id}`;
+    const bad = n.targets.find(t => !isSelector(t));
+    if (bad !== undefined) return `Unknown target "${String(bad).slice(0, 40)}" on ${n.id}`;
+  }
+  if (n.effects !== undefined) {
+    if (!n.effects || typeof n.effects !== 'object' || Array.isArray(n.effects)) return `Invalid effects on ${n.id}`;
+    for (const [label, e] of Object.entries(n.effects)) {
+      if (label.length > 60 || !Array.isArray(e) || e.length !== 2 || !STRATA_STATES.includes(e[0]) || !isSelector(e[1])) return `Invalid effect "${label.slice(0, 40)}" on ${n.id}`;
+    }
+  }
+  return null;
+}
+const ID = /^[A-Za-z0-9_.:@+~-]{1,120}$/;
+const str = (v: unknown, max: number) => typeof v === 'string' ? v.trim().slice(0, max) : '';
+/** A clean link from what a form or Strata sent. Throws with a message for the user on anything wrong. */
+export function cleanStrata(v: unknown, prev?: StrataLink | null): StrataLink | null {
+  if (v === undefined) return prev ?? null;
+  if (v === null) return null;
+  if (typeof v !== 'object' || Array.isArray(v)) throw new Error('The Strata link must be an object');
+  const b = v as Record<string, unknown>;
+  const site = b.site !== undefined ? str(b.site, 120) : prev?.site || '';
+  if (site && !ID.test(site)) throw new Error('The Strata IS id may hold letters, digits and . _ : @ + ~ - only');
+  const list = (x: unknown) => (Array.isArray(x) ? x : typeof x === 'string' ? x.split(/[,\n]/) : []).map(s => str(s, 120)).filter(Boolean);
+  const assets = b.assets !== undefined ? [...new Set(list(b.assets))].slice(0, 200) : prev?.assets || [];
+  const params: Record<string, string> = { ...(prev?.params || {}) };
+  if (b.params !== undefined) {
+    for (const k of Object.keys(params)) delete params[k];
+    if (b.params && typeof b.params === 'object' && !Array.isArray(b.params))
+      for (const [k, x] of Object.entries(b.params as Record<string, unknown>)) { if (/^\w{1,30}$/.test(k) && str(x, 120)) params[k] = str(x, 120); }
+  }
+  const marks: Record<string, StrataState> = { ...(prev?.marks || {}) };
+  if (b.marks !== undefined) {
+    for (const k of Object.keys(marks)) delete marks[k];
+    if (b.marks && typeof b.marks === 'object') for (const [k, x] of Object.entries(b.marks as Record<string, unknown>)) {
+      if (ID.test(k) && STRATA_STATES.includes(x as StrataState) && Object.keys(marks).length < 500) marks[k] = x as StrataState;
+    }
+  }
+  const names: Record<string, string> = { ...(prev?.names || {}) };
+  if (b.names && typeof b.names === 'object') for (const [k, x] of Object.entries(b.names as Record<string, unknown>)) { if (ID.test(k) && str(x, 120) && Object.keys(names).length < 500) names[k] = str(x, 120); }
+  if (!site && !assets.length && !Object.keys(params).length && !Object.keys(marks).length) return null;
+  return { site, assets, params, marks, names };
+}
+/** An entry Strata adds to the timeline: what it marked, cut or decided on the map. */
+export function strataLog(inc: Incident, msg: string, kind: LogKind, by: string, now = Date.now()): void {
+  const t = inc.status === 'active' ? clockNow(inc.clock, now) : (inc.endedAt ?? clockNow(inc.clock, now));
+  inc.log.push({ t, msg: `Strata: ${msg}`.slice(0, 500), kind, by });
+}
diff --git a/packages/core/src/types.ts b/packages/core/src/types.ts
index 5d019de..6fa4bee 100644
--- a/packages/core/src/types.ts
+++ b/packages/core/src/types.ts
@@ -16,6 +16,21 @@ export interface PNode {
   checklist: string[];
   x: number;
   y: number;
+  /** What the step acts on in Strata: selectors resolved on the map (affected, vuln:{cve}, flows:affected…). */
+  targets?: string[];
+  /** For a decision: answer → [state, selector], the assets Strata marks when that answer is given. */
+  effects?: Record<string, [StrataState, string]>;
+}
+
+export type StrataState = 'compromised' | 'suspected' | 'contained';
+/** Link to Strata: the IS, the assets the incident starts from, parameters for the targets, and the state of the assets as Strata reports it. */
+export interface StrataLink {
+  site: string;
+  assets: string[];
+  params: Record<string, string>;
+  marks: Record<string, StrataState>;
+  /** Asset id → name, as Strata knows it. */
+  names: Record<string, string>;
 }
 
 export interface PEdge {
@@ -113,6 +128,7 @@ export interface Incident {
   notes: string;
   reportId?: string | null;
   createdBy: string;
+  strata?: StrataLink | null;
 }
 
 export interface ReportStep {
@@ -140,6 +156,8 @@ export interface ReportData {
   decisions: { q: string; a: string; to: string }[];
   timeline: LogEntry[];
   notes: string;
+  /** The Strata IS and the assets as Strata last reported them; absent when the incident is not linked */
+  strata?: { site: string; assets: { id: string; name: string; state: StrataState }[] };
 }
 
 export interface Report {
@@ -155,7 +173,7 @@ export interface Report {
   data: ReportData;
 }
 
-export type SectionKey = 'summary' | 'timeline' | 'sla' | 'decisions' | 'notes' | 'signoff';
+export type SectionKey = 'summary' | 'timeline' | 'sla' | 'decisions' | 'assets' | 'notes' | 'signoff';
 
 export interface TemplateSection {
   key: SectionKey;
diff --git a/packages/pdf/src/index.ts b/packages/pdf/src/index.ts
index a2106b7..63e4ceb 100644
--- a/packages/pdf/src/index.ts
+++ b/packages/pdf/src/index.ts
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { PDFDocument, StandardFonts, rgb, type PDFFont, type PDFPage, type RGB } from 'pdf-lib';
 import {
-  type Report, type Template, fmtDur, fmtLong, fmtSla, fmtHM, fmtT, LOG_LABEL, reportStatusLabel
+  type Report, type Template, fmtDur, fmtLong, fmtSla, fmtHM, fmtT, LOG_LABEL, reportStatusLabel, reportSections
 } from '@muster/core';
 
 const PT = 2.8346; // points per mm
@@ -176,6 +176,13 @@ export async function renderReportPdf(t: Template, r: Report): Promise<Uint8Arra
         y += 12 * PT; line(M, y, A4.w - M, FAINT, 0.5); y += 2 * PT;
       }
     },
+    assets: () => {
+      const a = d.strata?.assets || [];
+      if (!a.length) para('No asset marked on the map.', 9.5, MUT, f.ital);
+      else table([{ head: 'ASSET', width: CW - 90, font: 'mono' }, { head: 'STATE', width: 90, align: 'right', font: 'bold' }], a.map(x => [x.name, x.state]),
+        (ri, ci) => ci === 1 ? (a[ri].state === 'compromised' ? CRIT : a[ri].state === 'suspected' ? WARN : OK) : undefined);
+      y += 6; para(`Reported by Strata, IS ${d.strata?.site || '-'}.`, 8.5, MUT, f.reg);
+    },
     signoff: () => {
       ensure(30 * PT);
       const w = (CW - 12 * PT) / 3;
@@ -190,7 +197,7 @@ export async function renderReportPdf(t: Template, r: Report): Promise<Uint8Arra
     }
   };
 
-  t.sections.filter(s => s.on).forEach((s, i) => {
+  reportSections(t, d).forEach((s, i) => {
     ensure(24 * PT);
     text(String(i + 1).padStart(2, '0'), M, y, f.mono, 8, ACC);
     text(s.title, M + 9 * PT, y, f.bold, 12, INK);
diff --git a/tests/api.test.mjs b/tests/api.test.mjs
index eed9aa8..cb5ad2b 100644
--- a/tests/api.test.mjs
+++ b/tests/api.test.mjs
@@ -170,6 +170,7 @@ test('incidents: declare, conflicting moves, tasks, SLA, close, report, PDF', as
   assert.equal(new TextDecoder().decode(pdf.data.slice(0, 5)), '%PDF-');
   const md = await a.get(`/api/reports/${rep.id}/markdown`);
   assert.match(md.data, /SLA performance/);
+  assert.doesNotMatch(md.data, /Assets hit/, 'an incident not linked to Strata has no Strata section');
   assert.equal((await a.patch(`/api/reports/${rep.id}`, { severity: 'Extreme' })).status, 400);
   assert.equal((await a.patch(`/api/reports/${rep.id}`, { severity: 'Low', summary: 'Edited' })).data.summary, 'Edited');
 });
@@ -303,3 +304,44 @@ test('password change: current password, strength, other sessions signed out', a
   assert.equal((await login('first-password')).status, 401);
   assert.equal((await login('second-password')).status, 200);
 });
+
+test('Strata: an incident linked to the map, steps that point at it, and what Strata reports back', async () => {
+  const a = await as('analyst'), v = await as('viewer'), ed = await as('editor');
+  const pbs = (await a.get('/api/playbooks')).data;
+  const vuln = (await a.get(`/api/playbooks/${pbs.find(p => p.code === 'PB-010').id}`)).data;
+  // the shipped playbook points at the map
+  const found = vuln.versions.at(-1).graph.nodes.find(n => n.id === 'found');
+  assert.deepEqual(found.targets, ['vuln:{cve}']);
+  assert.deepEqual(found.effects, { Yes: ['suspected', 'vuln:{cve}'] });
+  // a declared incident keeps its link; a bad IS id is refused
+  assert.equal((await a.post('/api/incidents', { playbookId: vuln.id, name: 'x', strata: { site: 'bad id!' } })).status, 400);
+  const inc = (await a.post('/api/incidents', { playbookId: vuln.id, name: 'Ivanti', mode: 'exercise', speed: 60, strata: { site: 'lyon', assets: 'vpn-gw, , vpn-gw', params: { cve: 'CVE-2024-21887', 'bad key': 'x' } } })).data;
+  assert.deepEqual(inc.strata, { site: 'lyon', assets: ['vpn-gw'], params: { cve: 'CVE-2024-21887' }, marks: {}, names: {} });
+  const row = (await a.get('/api/incidents')).data.find(i => i.id === inc.id);
+  assert.deepEqual(row.strata, { site: 'lyon', assets: ['vpn-gw'], params: { cve: 'CVE-2024-21887' } });
+  // Strata reports the marks and what it did; unknown states are dropped; viewers cannot
+  assert.equal((await v.post(`/api/incidents/${inc.id}/strata`, { marks: {} })).status, 403);
+  const r = await a.post(`/api/incidents/${inc.id}/strata`, { marks: { 'lyo-vpn-gw': 'suspected', 'lyo-x': 'pwned' }, names: { 'lyo-vpn-gw': 'vpn-gw' }, log: [{ msg: 'vpn-gw marked suspected', kind: 'warn', by: 'alice' }] });
+  assert.equal(r.status, 200, JSON.stringify(r.data));
+  assert.deepEqual(r.data.strata.marks, { 'lyo-vpn-gw': 'suspected' });
+  assert.equal(r.data.strata.site, 'lyon', 'the rest of the link stays');
+  const last = r.data.log.at(-1);
+  assert.equal(last.msg, 'Strata: vpn-gw marked suspected');
+  assert.match(last.by, / \(alice\)$/, 'the Strata user is named after the account Strata signs in with');
+  // the report lists the assets as Strata reported them, in Markdown and in the PDF
+  await a.post(`/api/incidents/${inc.id}/stop`);
+  const rep = (await a.post(`/api/incidents/${inc.id}/report`)).data;
+  assert.deepEqual(rep.data.strata, { site: 'lyon', assets: [{ id: 'lyo-vpn-gw', name: 'vpn-gw', state: 'suspected' }] });
+  const md = (await a.get(`/api/reports/${rep.id}/markdown`)).data;
+  assert.match(md, /## \d\d Assets hit \(Strata\)/);
+  assert.match(md, /\| vpn-gw \| suspected \|/);
+  assert.equal((await a.get(`/api/reports/${rep.id}/pdf`)).status, 200);
+  // a draft with an unknown target is refused, a known one is kept
+  const p = (await ed.get(`/api/playbooks/${vuln.id}`)).data;
+  p.draft.nodes.find(n => n.id === 'exposure').targets = ['everything'];
+  assert.equal((await ed.put(`/api/playbooks/${vuln.id}/draft`, { graph: p.draft, rev: p.rev })).status, 400);
+  p.draft.nodes.find(n => n.id === 'exposure').targets = ['vuln:{cve}', 'flows:reach:id:vpn-gw', 'role:Admin bastion'];
+  assert.equal((await ed.put(`/api/playbooks/${vuln.id}/draft`, { graph: p.draft, rev: p.rev })).status, 200);
+  const yaml = (await ed.get(`/api/playbooks/${vuln.id}/yaml`)).data;
+  assert.match(yaml, /targets: \["vuln:\{cve\}", "flows:reach:id:vpn-gw", "role:Admin bastion"\]/);
+});