Help Center / The incident workflow

The incident workflow

Everything inside a single incident: facts intake (including per-state individual-notice dates), roles, the playbook library, tasks, evidence, the communications log, the append-only timeline, the tabletop runner, and the exports.

Facts intake

The Incident facts panel is what drives the deadline engine. Set it carefully — every obligation and deadline is derived from these fields.

1. Fill in the fields.
2. Click Update facts & recompute.
3. The obligation table and the reminder cascade refresh, and a timeline event records that facts were updated and how many obligations resulted.

Format for the per-state count field: two-letter state codes, a colon or equals sign, then a number, separated by commas or new lines. Examples: CA:600, FL=200. Anything that doesn't match is ignored, so a typo simply drops that entry rather than corrupting the rest.

Per-state individual-notice dates

Most states' attorney-general clock runs from the same trigger as the individual notice (discovery). But a few run a separate clock that starts after you have notified that state's residents:

For these, Klaxon needs to know when you actually notified residents in that state. Record it in the Individual-notice date sent, per state field:

1. After you mail / email the individual notices for a state, come back to the incident facts.
2. Enter the date in the format CA:2026-06-10 (state code, colon, ISO date YYYY-MM-DD). Add more, comma-separated: CA:2026-06-10, OK:2026-06-12.
3. Click Update facts & recompute.

What changes:

• Before you record the date: the AG row shows an fallback — record notice date pill, and the AG deadline is anchored to the individual-notice deadline (the latest lawful start). This is deliberately conservative — the earliest the real clock could end is later than this, never sooner.
• After you record the date: the AG row shows a green from actual notice date pill, and the AG deadline equals your recorded notice date + the statutory days (CA +15, OK +60).

A single legacy global notice date is honored as a fallback for older incident records, but the per-state field is the supported, precise way to capture this. See the FAQ on AG anchoring.

Roles

Assign the five war-room roles so everyone knows their lane:

1. Type a name into each role field.
2. Click Save roles. The Incident Commander becomes the incident's commander; a timeline event records the update.

The playbook library

Klaxon ships eight curated runbooks, each mapped to the six-phase NIST incident-response lifecycle (Detect → Analyze → Contain → Eradicate → Recover → Post-Incident) with framework control maps and built-in notification-trigger checks:

Browse a playbook: open the Playbooks tab and click a card to read its phases, steps, owner roles, framework map, and the highlighted notification-trigger steps.

Launch a playbook into an incident:

1. Open the incident.
2. In the Launch playbook panel (bottom right), pick a playbook.
3. Click Launch → auto-create tasks. Every step in every phase becomes a tracked task on the incident, tagged with its owner role, and the incident's severity is set to the playbook's default. A timeline event records the launch.

Tasks

• Tasks come from launching a playbook, or you can add your own with the New task box.
• Check a task to mark it done (and uncheck to reopen). Each toggle is logged to the timeline.
• Tasks that came from a playbook show their owner role.

Evidence (chain-of-custody)

Attach evidence so its integrity is provable later — without ever uploading the file:

1. In the Evidence panel, choose a file.
2. Klaxon computes its SHA-256 hash in your browser and records the filename, the hash, and a timestamp. A timeline event notes the attachment with a short hash preview.
3. The file content is never uploaded — only the hash leaves nothing, it stays local too. The hash is your chain-of-custody fingerprint: anyone can re-hash the original file and compare.

Klaxon stores the fingerprint, not the file. Keep the original evidence files in your own secure evidence store; the hash proves the file you produce later is the same one you hashed during the incident.

Communications log

Auditors and cyber-insurers want a record of who was told what, and when. The Communications log captures it:

1. Pick an audience: Internal, Customers, Regulator, Law enforcement, Cyber-insurer, Vendor, or Media.
2. Type what was communicated and click Log.
3. Each entry is timestamped and also written to the append-only timeline. The log appears in the PIR and the auditor bundle.

The append-only timeline

The timeline is the forensic record of the incident. It is append-only: events are added, never edited or deleted through the UI. Events are created automatically (declaring, facts updates, role changes, task toggles, playbook launches, evidence, comms, filings, status changes) and you can add your own notes with the Log an event… box.

Every event is sealed into a SHA-256 hash chain the moment the incident is rendered, which makes any later tampering evident. A badge by the incident ID shows the chain's status. This is covered in depth on Timeline integrity.

Incident status

Use the Status dropdown to move the incident through its lifecycle: Open → Contained → Eradicated → Recovered → Closed. Setting it to Closed records a closed-at timestamp. Each change is logged to the timeline. The "what-changed" law feed only flags incidents that are not Closed.

Tabletop runner

Test your plan before a real incident. The Tabletop tab offers six scenarios:

1. Open a scenario to read its context and objectives.
2. Click Release next inject to reveal each timed inject and its decision prompt.
3. For each inject, check the rubric items the team satisfied. The running score updates.
4. When all injects are released, click Download AAR (Markdown) for an after-action report with the score, per-criterion results, gaps found, and recommended action items.
5. Use Reset exercise to run it again from scratch.

Exports (PIR, auditor bundle)

From an open incident you can export durable copies:

Two more exports live elsewhere: the deadline calendar (.ics) is exported from the Notification Engine, and notification letters (.txt / print-to-PDF) from the Letters tab.

← Getting started  ·  Next: Obligation clocks →