[0b3l1X-SolidGeeks]

Follows #58 (incident mode, merged). It needs SolidGeeks/muster#21 on the Muster side.

What changes

Server. Set MUSTER_URL, MUSTER_USER, MUSTER_PASSWORD (or MUSTER_PASSWORD_FILE) and MUSTER_POLL_SECONDS (default 10). server/muster.js then:

• signs in to Muster with an analyst account, keeps the session and opens it again on 401;
• reads the incidents every few seconds and sends a muster event when they change;
• passes calls on:
  • GET /api/muster and GET /api/muster/incidents/{id}: every role;
  • POST /api/muster/incidents/{id}/advance|tasks|strata: contributors and up.

Muster's refusals reach the user as they are, and an unreachable Muster gives a 502 with a clear message. The author of each log entry is set by the server, not by the page. api/me gains muster: {url}.

Interface. The incident sheet of an IS lists the Muster responses linked to it, or naming its assets, and offers the others with Open on this IS.

• Opening marks the assets the incident names (by name or Strata id). Unknown ones are listed, and a CVE parameter selects the assets carrying it.
• Running: the playbook frozen in the incident runs from the map, with the targets Muster stores on each step.
• Both ways: answers, finished steps and tasks move the response in Muster, and what Muster's analysts do shows on the map within seconds.
• Effects: a decision answered anywhere applies its effects once, tracked by the number of steps already seen.
• Reporting back: marks and flows cut go to Muster's timeline and to the Assets hit (Strata) section of its report.

One incident, its own assets. Opening another incident on an IS puts the marks and cuts of the previous one aside, with a line in the timeline. Marks made by hand before any incident stay.

Without MUSTER_URL nothing changes: the example incidents from #58 stay. A run points to Muster only when it carries a Muster id, so examples saved before this change keep working (that was a regression on this branch, fixed and tested).

Known limit

A decision answered in Muster marks the assets in Strata when a contributor next has that IS open in Strata, not on the server. Nothing is lost in between. This is documented.

Tests

• npm test: 76 pass. New: tests/muster.test.mjs runs a real Strata against a stand-in Muster and covers:

  • sign-in kept, and re-opened after a 401;
  • roles;
  • a Muster refusal passed on;
  • the CSRF header and the server-set author;
  • an unreachable Muster.

  Unit tests cover the conversion of a Muster incident into a run, answers applied once, the link between incidents and IS, and putting marks aside.

• npm run test:e2e: both pass locally.

• End to end with a real Muster (muster#21) on both sides:

  • a ransomware incident declared in Muster with two Lyon assets, run from Strata (step, decision, task, flow cut), all visible in Muster's timeline;
  • a PB-010 decision answered in Muster marking hmi-01 and jump-win suspected in Strata;
  • Muster's report listing them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ke7yEW5dhDYFVpV2cdgs87