RocketCyber Incidents

RocketCyber Incident Management

Overview

Incidents are the core artifact in RocketCyber's managed SOC platform. When the SOC detects a potential threat -- through endpoint telemetry, log analysis, or behavioral detection -- it creates an incident. MSP technicians and SOC analysts use incidents to investigate threats, determine verdicts, and take remediation actions.

The incident system supports:

• Automated Detection - Threats identified by RocketCyber's detection engine
• SOC Analyst Review - Human analysts review and assign verdicts
• MSP Triage - MSP technicians investigate and remediate at the customer level
• Audit Trail - Full history of incident status changes and actions

Key Concepts

Incident Lifecycle

┌─────────┐    Analyst    ┌──────────────┐    Resolved    ┌───────────┐
│   New   │ ──────────>   │ In Progress  │ ────────────>  │ Resolved  │
└─────────┘               └──────────────┘                └───────────┘
     │                          │
     │                          │  Determined benign
     │                          ▼
     │                    ┌────────────────┐
     └──────────────────> │ False Positive │
                          └────────────────┘

1. New - Incident created by detection engine; awaiting review
2. In Progress - Analyst or technician actively investigating
3. Resolved - Threat confirmed and remediated, or determined non-threatening
4. False Positive - Investigated and determined to not be a real threat

Verdicts

Verdicts represent the SOC analyst's assessment of the threat:

| Verdict | Description | Typical Action | |---------|-------------|----------------| | Malicious | Confirmed threat requiring immediate remediation | Isolate endpoint, remove threat, notify customer | | Suspicious | Potentially threatening; requires further investigation | Monitor closely, gather additional evidence | | Benign | Activity is legitimate and not a threat | Close incident, update detection rules if needed |

Severity Levels

| Severity | Description | SLA Target | |----------|-------------|------------| | Critical | Active breach or imminent threat to business operations | Immediate (15 min) | | High | Confirmed malicious activity requiring urgent response | 1 hour | | Medium | Suspicious activity that needs investigation | 4 hours | | Low | Minor anomaly or informational finding | 8 hours |

Field Reference

| Field | Type | Description | |-------|------|-------------| | id | integer | Unique incident identifier | | title | string | Short description of the incident | | description | string | Detailed incident narrative from SOC | | status | string | Current status: New, In Progress, Resolved, False Positive | | severity | string | Severity level: Critical, High, Medium, Low | | verdict | string | Analyst verdict: Malicious, Suspicious, Benign | | accountId | integer | Customer account where the incident occurred | | accountName | string | Customer account name (verify against API docs) | | createdAt | datetime | When the incident was created | | updatedAt | datetime | When the incident was last updated | | resolvedAt | datetime | When the incident was resolved (if applicable) | | assignedTo | string | Analyst or resource assigned to the incident (verify against API docs) | | eventCount | integer | Number of related threat events (verify against API docs) | | affectedDevices | array | List of endpoints involved (verify against API docs) |

Note: Field names are inferred from the Celerium PowerShell wrapper and common SOC platform conventions. Verify exact field names against RocketCyber API responses.

API Patterns

List Incidents

# All incidents (most recent first)
curl -s "https://api-${ROCKETCYBER_REGION:-us}.rocketcyber.com/v3/incidents" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Response (verify against API docs):

{
  "data": [
    {
      "id": 98765,
      "title": "Suspicious PowerShell execution detected",
      "status": "New",
      "severity": "High",
      "verdict": "Suspicious",
      "accountId": 12345,
      "createdAt": "2026-02-22T14:30:00Z",
      "updatedAt": "2026-02-22T14:30:00Z"
    }
  ],
  "totalCount": 245,
  "page": 1,
  "limit": 50
}

Filter Incidents by Account

# Incidents for a specific customer
curl -s "https://api-us.rocketcyber.com/v3/incidents?accountId=12345" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Filter Incidents by Status

# Only open (New + In Progress) incidents
curl -s "https://api-us.rocketcyber.com/v3/incidents?status=open" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

# Only resolved incidents
curl -s "https://api-us.rocketcyber.com/v3/incidents?status=resolved" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Note: The exact query parameter values for status filtering (e.g., status=open vs status=New) should be verified against the API documentation.

Filter Incidents by Severity

# Critical incidents only
curl -s "https://api-us.rocketcyber.com/v3/incidents?severity=critical" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Filter Incidents by Date Range

# Incidents from the last 7 days (verify date parameter format)
curl -s "https://api-us.rocketcyber.com/v3/incidents?startDate=2026-02-16T00:00:00Z&endDate=2026-02-23T00:00:00Z" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Get Incident Details

# Single incident with full details
curl -s "https://api-us.rocketcyber.com/v3/incidents/98765" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Response (verify against API docs):

{
  "id": 98765,
  "title": "Suspicious PowerShell execution detected",
  "description": "Encoded PowerShell command detected on WORKSTATION-01. The command attempts to download and execute a remote script from an external IP address.",
  "status": "In Progress",
  "severity": "High",
  "verdict": "Malicious",
  "accountId": 12345,
  "accountName": "Acme Corporation",
  "createdAt": "2026-02-22T14:30:00Z",
  "updatedAt": "2026-02-22T15:45:00Z",
  "resolvedAt": null,
  "eventCount": 3,
  "affectedDevices": [
    {
      "hostname": "WORKSTATION-01",
      "os": "Windows 11",
      "lastSeen": "2026-02-22T15:30:00Z"
    }
  ]
}

Common Workflows

SOC Analyst Triage Pattern

1. Query new incidents -- filter by status=New, sort by severity descending
2. Review highest severity first -- Critical and High take priority
3. Check incident details -- review description, affected devices, event count
4. Investigate threat events -- cross-reference with events endpoint
5. Assign verdict -- Malicious, Suspicious, or Benign
6. Take action -- remediate (Malicious), monitor (Suspicious), or close (Benign)
7. Update status -- move to Resolved or False Positive

Daily Security Review

1. List all incidents created in the last 24 hours
2. Count by severity: Critical / High / Medium / Low
3. Count by verdict: Malicious / Suspicious / Benign / Pending
4. Identify any unreviewed Critical or High incidents
5. Check for recurring incident patterns across accounts

Customer Security Report

1. Filter incidents by accountId for the target customer
2. Summarize incidents by severity and verdict for the reporting period
3. Highlight resolved Malicious incidents with remediation details
4. Note any ongoing Suspicious incidents requiring monitoring
5. Include agent health status and coverage metrics

Cross-Vendor PSA Ticket Correlation

RocketCyber incidents often need to be correlated with PSA tickets for billing and tracking:

1. When a Malicious or Suspicious incident is confirmed, create a corresponding ticket in your PSA (Autotask, ConnectWise, HaloPSA, etc.)
2. Include the RocketCyber incident ID in the PSA ticket for cross-reference
3. Use the inci