Connect to Muster: its incidents open on the map and run from there

.env.example

@@ -66,6 +66,13 @@ HOST=0.0.0.0
 # Longest a connector run may take before it is stopped
 # CONNECTOR_TIMEOUT_MINUTES=30
 
+# Muster (incident response playbooks): its incidents open on the map. Create the account in Muster with the
+# analyst role. MUSTER_PASSWORD_FILE reads the password from a file.
+# MUSTER_URL=http://muster:8080
+# MUSTER_USER=strata
+# MUSTER_PASSWORD=
+# MUSTER_POLL_SECONDS=10
+
 # "Source code" link in the app (AGPL). Point it at your fork if you modify Strata.
 # SOURCE_URL=https://github.com/SolidGeeks/strata
 

CHANGELOG.md

@@ -10,9 +10,10 @@ All notable changes to Strata. Versions follow [Semantic Versioning](https://sem
   - **what depends on them**: business services hit, the assets that call them, the assets an attacker reaches next along the flows that leave them;
   - a timeline of every mark, cut and decision.
   The 3D model and the 2D diagram dim the rest, ring the assets hit and draw the flows to cut in red, the cut ones in grey. A red band in the title block keeps the incident in view.
-- **Muster incidents open on the map.** A Muster incident carries Strata asset ids or parameters (a CVE); its playbook runs in the incident sheet, and each step points at the map through `targets` selectors (`affected`, `vuln:{cve}`, `role:backup`, `type:dc`, `flows:…`, `reach:…`, `consumers:…`, `business:…`, `contacts:…`). A decision can mark assets (`effects`). Ransomware (PB-001) and Exploited critical vulnerability (PB-010) are included. Until Muster is connected to a Strata server, the sheet offers two example incidents built from the map.
+- **Muster incidents open on the map.** A Muster incident carries Strata asset ids or parameters (a CVE); its playbook runs in the incident sheet, and each step points at the map through `targets` selectors (`affected`, `vuln:{cve}`, `role:backup`, `type:dc`, `flows:…`, `reach:…`, `consumers:…`, `business:…`, `contacts:…`). A decision can mark assets (`effects`). Ransomware (PB-001) and Exploited critical vulnerability (PB-010) are included. Muster stores these on each step (see its changelog); without a Muster connection, the sheet offers two example incidents built from the map.
 - **Anonymised AI prompts per asset** (*AI prompts* on an asset sheet): one prompt for the major risks of the asset, one guide that has the AI list plausible incidents and write their response playbooks in Muster's `muster/v1` YAML, with `targets`. Names, addresses, subnets, contacts and the IS name are replaced by placeholders (`ASSET-T`, `ASSET-01`, `SEG-1`, `SVC-B1`); a leak check lists anything identifying left in the text, with your own terms to never send; the answer pasted back gets your names again, in the page only. French or English.
-- **API**: `GET /api/incidents`, `PUT /api/incidents/{IS id}` (contributors and up, no proposal), and an `incidents` event on `/api/events`. Kept in `incidents.json`, outside the map and its history.
+- **The connection to Muster** (`MUSTER_URL`, `MUSTER_USER`, `MUSTER_PASSWORD`). This server signs in to Muster with an analyst account and lists its responses; the incident sheet of an IS shows those linked to it (declared in Muster with this IS, or naming its assets), and the others with *Open on this IS*. Opening one marks the assets it names, then the playbook runs from the map: answering a decision or finishing a step moves the response in Muster, the tasks ticked go both ways, and what Muster's analysts do shows on the map within seconds. A decision answered anywhere marks the assets its `effects` name. Every mark and every flow cut goes to Muster's timeline, so its report keeps them, written by the Strata account with the name of the person who did it. Each incident is its own situation: opening another one on the same IS puts the marks and cuts of the previous one aside (marks made by hand before any incident stay). A decision answered in Muster marks the assets as soon as a contributor has the IS open in Strata. Muster's report gets an *Assets hit (Strata)* section. Without `MUSTER_URL`, the two example incidents stay.
+- **API**: `GET /api/incidents`, `PUT /api/incidents/{IS id}` (contributors and up, no proposal), `GET /api/muster`, `GET /api/muster/incidents/{id}`, `POST /api/muster/incidents/{id}/advance`, `/tasks`, `/strata`, and the `incidents` and `muster` events on `/api/events`. Kept in `incidents.json`, outside the map and its history.
 - **One-page build**: `npm run build:online` writes `dist-online/strata.html`, the whole interface without a server (map kept in the browser, three.js from jsDelivr).
 
 ## [0.9.0] - 2026-10-26

README.md

@@ -233,6 +233,9 @@ By default, the port only listens on the machine itself (`127.0.0.1:8080`). To o
 | `MODULE_UPLOAD` | `false` | `true` lets administrators install a module package from a file (no checksum: whoever uploads it vouches for it). |
 | `MODULES_DIR` | — | A folder of connector modules you provide yourself, one sub-folder each ([MODULES.md](MODULES.md)). |
 | `CONNECTOR_TIMEOUT_MINUTES` | `30` | Longest a connector run may take before it is stopped (2 minutes at most for a test). |
+| `MUSTER_URL` | — | Address of your [Muster](https://github.com/SolidGeeks/muster) server, as this server reaches it (`http://muster:8080`). Its incidents then open on the map, in the incident sheet of the IS they name. Empty: no connection. |
+| `MUSTER_USER` / `MUSTER_PASSWORD` | `strata` / — | The Muster account Strata signs in with: create it in Muster with the **analyst** role. `MUSTER_PASSWORD_FILE` reads the password from a file. |
+| `MUSTER_POLL_SECONDS` | `10` | How often Strata reads Muster's incidents; every page then follows. |
 | `SOURCE_URL` | `https://github.com/SolidGeeks/strata` | The app's *Source code* link (AGPL): point it at your fork if you modify the code. |
 
 After changing `.env`, apply it with `docker compose up -d`.
@@ -460,6 +463,9 @@ Every route needs the same credentials as the interface (a local account with Ba
 | `PUT /api/wan` | Replaces the links between IS: `{"links": [...]}` |
 | `POST /api/import` | Replaces the whole map: `{si, assets, wan, services}` |
 | `GET /api/incidents` | Incident mode of every IS: `{incidents: {<IS id>: {on, marks, cuts, run, log}}}` |
+| `GET /api/muster` | Muster's incidents and whether Muster answers (`{url, ok, error, incidents}`), when `MUSTER_URL` is set |
+| `GET /api/muster/incidents/{id}` | One Muster incident: its frozen playbook, the steps taken, the link to Strata |
+| `POST /api/muster/incidents/{id}/advance`, `/tasks`, `/strata` | Passed on to Muster (`contributor` and up): answer a step `{edgeId}`, tick a task `{nodeId, index, done}`, report the assets and what was done `{site, marks, names, log}` |
 | `PUT /api/incidents/{IS id}` | Replaces the incident of an IS (`contributor` and up, no proposal): marks are `compromised`, `suspected` or `contained` |
 | `PUT /api/services` | Replaces the common catalogue of Internet services: `{"services": [...]}` |
 | `GET /api/history` | Latest changes (`?before=REV&limit=N`); `GET /api/history/{rev}`: the before/after details |

package.json

@@ -12,7 +12,7 @@
   "scripts": {
     "vendor": "node scripts/vendor.mjs",
     "start": "node server/server.js",
-    "test": "node --test tests/api.test.mjs tests/analysis.test.mjs tests/incident.test.mjs tests/secrets.test.mjs tests/signin.test.mjs tests/hardening.test.mjs tests/readonly.test.mjs tests/modules.test.mjs tests/sso.test.mjs",
+    "test": "node --test tests/api.test.mjs tests/analysis.test.mjs tests/incident.test.mjs tests/muster.test.mjs tests/secrets.test.mjs tests/signin.test.mjs tests/hardening.test.mjs tests/readonly.test.mjs tests/modules.test.mjs tests/sso.test.mjs",
     "test:e2e": "node --test tests/e2e.mjs",
     "setup": "npm ci && npm run vendor",
     "build:online": "node scripts/build-online.mjs"