<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Incident Classification — API Reference

## ServiceNow Security Incident API

```python
import requests

SN_URL = "https://instance.service-now.com"
SN_AUTH = ("svc-soar", "password")

# Create security incident
resp = requests.post(f"{SN_URL}/api/now/table/sn_si_incident", auth=SN_AUTH, json={
    "short_description": "Malware detected on web-01",
    "category": "malware",
    "subcategory": "trojan",
    "severity": 1,
    "priority": 1,
    "assignment_group": "SOC Tier 1",
})

# Update classification
requests.patch(f"{SN_URL}/api/now/table/sn_si_incident/{sys_id}", auth=SN_AUTH, json={
    "category": "malware",
    "subcategory": "ransomware",
    "severity": 1,
})
```

## Jira Issue Classification

```python
from jira import JIRA

jira = JIRA(server="https://jira.corp.local", basic_auth=("svc-soar", "token"))

# Update incident classification
issue = jira.issue("INC-001")
issue.update(fields={
    "customfield_10001": "malware",       # Category
    "customfield_10002": "ransomware",    # Subcategory
    "priority": {"name": "Critical"},
})
```

## Classification Severity Matrix

| Alert Severity | Asset: Mission-Critical | Asset: High | Asset: Standard | Asset: Low |
|---------------|------------------------|-------------|-----------------|-----------|
| Critical | P1 (Critical) | P1 (Critical) | P2 (High) | P3 (Medium) |
| High | P1 (Critical) | P2 (High) | P2 (High) | P3 (Medium) |
| Medium | P2 (High) | P2 (High) | P3 (Medium) | P4 (Low) |
| Low | P3 (Medium) | P3 (Medium) | P4 (Low) | P4 (Low) |

## NIST Incident Categories

| Category | Description |
|----------|-------------|
| CAT 1 | Unauthorized Access |
| CAT 2 | Denial of Service |
| CAT 3 | Malicious Code |
| CAT 4 | Improper Usage |
| CAT 5 | Scans/Probes |
| CAT 6 | Investigation |

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Classification completed |
| 1 | Classification with low confidence |
| 2 | Classification failed |
