RocketCyber Incidents

RocketCyber Incident Management

Overview

Incidents are the core artifact in RocketCyber's managed SOC platform. When the SOC detects a potential threat -- through endpoint telemetry, log analysis, or behavioral detection -- it creates an incident. MSP technicians and SOC analysts use incidents to investigate threats, determine verdicts, and take remediation actions.

The incident system supports:

• Automated Detection - Threats identified by RocketCyber's detection engine
• SOC Analyst Review - Human analysts review and assign verdicts
• MSP Triage - MSP technicians investigate and remediate at the customer level
• Audit Trail - Full history of incident status changes and actions

Anti-triggers

• A monitor firing rather than an analyst verdict — Datto RMM raises its own antivirus and ransomware alerts with no SOC review; use datto-rmm-alerts.
• The PSA ticket raised from an incident — use autotask-tickets; RocketCyber incident IDs and Autotask ticket IDs are unrelated.
• The coverage gap behind a missing detection — use rocketcyber-agents.

Key Concepts

Incident Lifecycle

┌─────────┐    Analyst    ┌──────────────┐    Resolved    ┌───────────┐
│   New   │ ──────────>   │ In Progress  │ ────────────>  │ Resolved  │
└─────────┘               └──────────────┘                └───────────┘
     │                          │
     │                          │  Determined benign
     │                          ▼
     │                    ┌────────────────┐
     └──────────────────> │ False Positive │
                          └────────────────┘

1. New - Incident created by detection engine; awaiting review
2. In Progress - Analyst or technician actively investigating
3. Resolved - Threat confirmed and remediated, or determined non-threatening
4. False Positive - Investigated and determined to not be a real threat

Verdicts

Verdicts represent the SOC analyst's assessment of the threat:

Severity Levels

Field Reference

Note: Field names are inferred from the Celerium PowerShell wrapper and common SOC platform conventions. Verify exact field names against RocketCyber API responses.

API Patterns

List Incidents

# All incidents (most recent first)
curl -s "https://api-${ROCKETCYBER_REGION:-us}.rocketcyber.com/v3/incidents" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Response (verify against API docs):

{
  "data": [
    {
      "id": 98765,
      "title": "Suspicious PowerShell execution detected",
      "status": "New",
      "severity": "High",
      "verdict": "Suspicious",
      "accountId": 12345,
      "createdAt": "2026-02-22T14:30:00Z",
      "updatedAt": "2026-02-22T14:30:00Z"
    }
  ],
  "totalCount": 245,
  "page": 1,
  "limit": 50
}

Filter Incidents by Account

# Incidents for a specific customer
curl -s "https://api-us.rocketcyber.com/v3/incidents?accountId=12345" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Filter Incidents by Status

# Only open (New + In Progress) incidents
curl -s "https://api-us.rocketcyber.com/v3/incidents?status=open" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

# Only resolved incidents
curl -s "https://api-us.rocketcyber.com/v3/incidents?status=resolved" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Note: The exact query parameter values for status filtering (e.g., status=open vs status=New) should be verified against the API documentation.

Filter Incidents by Severity

# Critical incidents only
curl -s "https://api-us.rocketcyber.com/v3/incidents?severity=critical" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Filter Incidents by Date Range

# Incidents from the last 7 days (verify date parameter format)
curl -s "https://api-us.rocketcyber.com/v3/incidents?startDate=2026-02-16T00:00:00Z&endDate=2026-02-23T00:00:00Z" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Get Incident Details

# Single incident with full details
curl -s "https://api-us.rocketcyber.com/v3/incidents/98765" \
  -H "Authorization: Bearer ${ROCKETCYBER_API_KEY}"

Response (verify against API docs):

{
  "id": 98765,
  "title": "Suspicious PowerShell execution detected",
  "description": "Encoded PowerShell command detected on WORKSTATION-01. The command attempts to download and execute a remote script from an external IP address.",
  "status": "In Progress",
  "severity": "High",
  "verdict": "Malicious",
  "accountId": 12345,
  "accountName": "Acme Corporation",
  "createdAt": "2026-02-22T14:30:00Z",
  "updatedAt": "2026-02-22T15:45:00Z",
  "resolvedAt": null,
  "eventCount": 3,
  "affectedDevices": [
    {
      "hostname": "WORKSTATION-01",
      "os": "Windows 11",
      "lastSeen": "2026-02-22T15:30:00Z"
    }
  ]
}

Common Workflows

SOC Analyst Triage Pattern

1. Query new incidents -- filter by status=New, sort by severity descending
2. Review highest severity first -- Critical and High take priority
3. Check incident details -- review description, affected devices, event count
4. Investigate threat events -- cross-reference with events endpoint
5. Assign verdict -- Malicious, Suspicious, or Benign
6. Take action -- remediate (Malicious), monitor (Suspicious), or close (Benign)
7. Update status -- move to Resolved or False Positive

Daily Security Review

1. List all incidents created in the last 24 hours
2. Count by severity: Critical / High / Medium / Low
3. Count by verdict: Malicious / Suspicious / Benign / Pending
4. Identify any unreviewed Critical or High incidents
5. Check for recurring incident patterns across accounts

Customer Security Report

1. Filter incidents by accountId for the target customer
2. Summarize incidents by severity and verdict for the reporting period
3. Highlight resolved Malicious incidents with remediation details
4. Note any ongoing Suspicious incidents requiring monitoring
5. Include agent health status and coverage metrics

Cross-Vendor PSA Ticket Correlation

RocketCyber incidents often need to be correlated with PSA tickets for billing and tracking:

1. When a Malicious or Suspicious incident is confirmed, create a corresponding ticket in your PSA (Autotask, ConnectWise, HaloPSA, etc.)
2. Include the RocketCyber incident ID in the PSA ticket for cross-reference
3. Use the incident severity to set PSA ticket priority
4. When the RocketCyber incident is resolved, update the PSA ticket accordingly

See also: shared incident correlation skills if available in shared/skills/

Error Handling

Common Errors

Authentication Error

401 Unauthorized

Verify your RocketCyber credentials:
- ROCKETCYBER_API_KEY: Your API key from Provider Settings > API tab
- Ensure the key has not been revoked or regenerated

Related Skills

• api-patterns - Authentication, pagination, error handling
• agents - Agent deployment and health (affected devices context)
• accounts - Account hierarchy (incident scoping)
• apps - Application inventory (application-layer threats)