feat: implement GRC regulatory compliance scoring and continuous audi…

[dipanshubatra]

Description

Close #556
Introduces a comprehensive Cyber Incident Response (IR) Playbooks & Forensics subsystem that centralizes incident response automation, threat containment, remediation orchestration, and forensic evidence management.

The implementation enables organizations to execute automated incident response playbooks, monitor containment activities in real time, coordinate remediation workflows, collect forensic memory dumps, export investigation packages, and strengthen Security Operations Center (SOC) capabilities through unified dashboards and analytics.

Fixes # (issue)

---

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

---

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated tests covering incident response workflows and forensic operations
• My changes generate no new warnings
• New and existing tests pass locally with my changes
• Documentation updates will be completed separately if required
• Any dependent changes have been merged and published in downstream modules

#Closed #(issue number)

---

Summary by CodeRabbit

New Features

• Added a Cyber Incident Response (IR) Playbooks & Forensics subsystem.
• Implemented an automated incident response playbook library supporting ransomware endpoint isolation, compromised credential revocation, PHI data protection, and API secret rotation.
• Added real-time containment telemetry and active remediation monitoring dashboards.
• Introduced an interactive step-by-step playbook execution runner for guided incident response.
• Added forensic memory dump management with downloadable ZIP evidence packages.
• Integrated Incident Response operations into the Enterprise Security Center with centralized navigation and operational visibility.

Security

• Improved incident response times through automated playbook execution and guided remediation workflows.
• Enhanced threat containment with live telemetry, containment diagnostics, and remediation tracking.
• Strengthened forensic readiness through centralized evidence collection and memory dump management.
• Increased operational visibility with unified incident dashboards, execution history, and forensic ledgers.
• Improved governance through standardized response procedures, audit-ready evidence, and post-incident reporting.

Technical Improvements

• Added frontend API services for incident response automation, containment telemetry, playbook execution, and forensic package generation.
• Implemented Incident Response dashboards, playbook management interfaces, containment monitoring views, forensic evidence ledgers, and export functionality.
• Registered dedicated routes for incident response and forensic operations and integrated the subsystem into the Enterprise Security Center.
• Added support for automated remediation workflows, forensic evidence exports, and operational telemetry.
• Improved the platform's enterprise security architecture with centralized incident response orchestration and forensic investigation capabilities.

Summary by CodeRabbit

• New Features
  • Added an Incident Response Playbooks page with readiness status and dashboard navigation.
  • Browse, search, and filter available response playbooks and active incidents.
  • Run playbooks against user emails or host IPs with step-by-step execution results.
  • View incident response metrics and receive status notifications.
  • Export forensic packages for investigated incidents.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 52e2083f-c02e-40bf-bcdb-47efc171d1bc

📥 Commits

Reviewing files that changed from the base of the PR and between a69e867 and 3023dd7.

📒 Files selected for processing (3)

• src/components/auth/IncidentResponsePlaybookPanel.jsx
• src/pages/auth/IncidentResponsePlaybookPage.jsx
• src/services/IncidentResponsePlaybookService.js

---

📝 Walkthrough

Walkthrough

Adds an authenticated Incident Response Playbooks page, a panel for playbook and incident management, and a service layer for retrieving, executing, and exporting incident response data.

Changes

Incident response subsystem

Layer / File(s)	Summary
IR service operations src/services/IncidentResponsePlaybookService.js	Adds API operations for retrieving playbooks and active incidents, executing playbooks, and exporting forensic packages, with fallback response data.
Panel data and execution orchestration src/components/auth/IncidentResponsePlaybookPanel.jsx	Loads IR data, derives metrics and filtered playbooks, and handles execution and forensic export actions.
Playbook and incident workflows src/components/auth/IncidentResponsePlaybookPanel.jsx	Renders telemetry, notifications, tabs, playbook cards, incident entries, and the execution results modal.
Authenticated IR page integration src/pages/auth/IncidentResponsePlaybookPage.jsx	Adds the full-height authenticated page, dashboard navigation, status header, and embedded IR panel.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant IncidentResponsePlaybookPage
  participant IncidentResponsePlaybookPanel
  participant IncidentResponsePlaybookService
  participant IRBackend
  IncidentResponsePlaybookPage->>IncidentResponsePlaybookPanel: render IR interface
  IncidentResponsePlaybookPanel->>IncidentResponsePlaybookService: load playbooks and incidents
  IncidentResponsePlaybookService->>IRBackend: request IR data
  IRBackend-->>IncidentResponsePlaybookService: return IR data
  IncidentResponsePlaybookPanel->>IncidentResponsePlaybookService: execute playbook or export forensics
  IncidentResponsePlaybookService->>IRBackend: submit operation
  IRBackend-->>IncidentResponsePlaybookService: return operation result
  IncidentResponsePlaybookService-->>IncidentResponsePlaybookPanel: update execution or export state

Loading

Suggested reviewers: kramu81

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}