{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://aerialytic.ai/schemas/incident.schema.json",
  "title": "Enterprise Incident",
  "type": "object",
  "additionalProperties": false,
  "required": ["id", "title", "summary", "category", "severity", "status", "createdAt", "timezone", "ownership", "environment", "affectedScope", "timeline", "evidence", "actions", "audit"],
  "properties": {
    "id": { "type": "string", "pattern": "^INC-[0-9]{4}-[0-9]{4,}$" },
    "title": { "type": "string", "minLength": 3, "maxLength": 240 },
    "summary": { "type": "string" },
    "category": { "$ref": "#/$defs/category" },
    "severity": { "$ref": "#/$defs/severity" },
    "status": { "$ref": "#/$defs/lifecycleState" },
    "createdAt": { "type": "string", "format": "date-time" },
    "updatedAt": { "type": "string", "format": "date-time" },
    "timezone": { "type": "string", "examples": ["America/Toronto", "UTC"] },
    "startedAt": { "type": ["string", "null"], "format": "date-time" },
    "detectedAt": { "type": ["string", "null"], "format": "date-time" },
    "resolvedAt": { "type": ["string", "null"], "format": "date-time" },
    "closedAt": { "type": ["string", "null"], "format": "date-time" },
    "lifecycleTransitions": { "type": "array", "items": { "$ref": "#/$defs/lifecycleTransition" }, "default": [] },
    "environment": { "$ref": "#/$defs/environment" },
    "ownership": { "$ref": "#/$defs/ownership" },
    "affectedScope": { "$ref": "#/$defs/affectedScope" },
    "impactAssessments": { "type": "array", "items": { "$ref": "#/$defs/impactAssessment" }, "default": [] },
    "timeline": { "type": "array", "items": { "$ref": "#/$defs/timelineEvent" }, "default": [] },
    "evidence": { "type": "array", "items": { "$ref": "#/$defs/evidenceItem" }, "default": [] },
    "attachments": { "type": "array", "items": { "$ref": "#/$defs/attachment" }, "default": [] },
    "decisions": { "type": "array", "items": { "$ref": "#/$defs/decision" }, "default": [] },
    "communications": { "type": "array", "items": { "$ref": "#/$defs/communication" }, "default": [] },
    "rca": { "$ref": "#/$defs/rca" },
    "actions": { "type": "array", "items": { "$ref": "#/$defs/actionItem" }, "default": [] },
    "security": { "$ref": "#/$defs/securityExtension" },
    "reliability": { "$ref": "#/$defs/reliabilityExtension" },
    "regulatory": { "$ref": "#/$defs/regulatoryExtension" },
    "audit": { "$ref": "#/$defs/audit" },
    "customFields": { "type": "object", "additionalProperties": true }
  },
  "$defs": {
    "lifecycleState": {
      "type": "string",
      "enum": ["draft", "open", "acknowledged", "investigating", "identified", "mitigating", "contained", "recovering", "monitoring", "resolved", "postmortem", "verified", "closed"]
    },
    "category": {
      "type": "object",
      "required": ["id", "name", "family"],
      "additionalProperties": false,
      "properties": {
        "id": { "type": "string" },
        "name": { "type": "string" },
        "family": { "type": "string" },
        "tags": { "type": "array", "items": { "type": "string" }, "default": [] },
        "playbookBindings": { "type": "array", "items": { "$ref": "#/$defs/linkRef" }, "default": [] },
        "requiredExtensions": { "type": "array", "items": { "type": "string" }, "default": [] }
      }
    },
    "severity": {
      "type": "object",
      "required": ["internal"],
      "additionalProperties": false,
      "properties": {
        "internal": { "type": "string", "enum": ["SEV0", "SEV1", "SEV2", "SEV3", "SEV4"] },
        "customer": { "type": ["string", "null"], "enum": ["critical", "major", "minor", "none", null] },
        "security": { "type": ["string", "null"], "enum": ["critical", "high", "medium", "low", "none", null] },
        "confidence": { "type": "string", "enum": ["low", "medium", "high", "confirmed"], "default": "medium" }
      }
    },
    "environment": {
      "type": "object",
      "required": ["name"],
      "additionalProperties": false,
      "properties": {
        "name": { "type": "string" },
        "cloudProviders": { "type": "array", "items": { "type": "string" } },
        "regions": { "type": "array", "items": { "type": "string" } },
        "clusters": { "type": "array", "items": { "type": "string" } },
        "applications": { "type": "array", "items": { "type": "string" } },
        "services": { "type": "array", "items": { "type": "string" } },
        "dependencies": { "type": "array", "items": { "type": "string" } }
      }
    },
    "ownership": {
      "type": "object",
      "required": ["incidentCommander"],
      "additionalProperties": false,
      "properties": {
        "incidentCommander": { "$ref": "#/$defs/actor" },
        "communicationsLead": { "$ref": "#/$defs/actor" },
        "engineeringLead": { "$ref": "#/$defs/actor" },
        "securityLead": { "$ref": "#/$defs/actor" },
        "executiveSponsor": { "$ref": "#/$defs/actor" },
        "approvers": { "type": "array", "items": { "$ref": "#/$defs/actor" }, "default": [] },
        "stakeholders": { "type": "array", "items": { "$ref": "#/$defs/actor" }, "default": [] }
      }
    },
    "affectedScope": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "customers": { "type": "array", "items": { "type": "string" }, "default": [] },
        "businessUnits": { "type": "array", "items": { "type": "string" }, "default": [] },
        "assets": { "type": "array", "items": { "type": "string" }, "default": [] },
        "services": { "type": "array", "items": { "type": "string" }, "default": [] },
        "dataClasses": { "type": "array", "items": { "type": "string" }, "default": [] },
        "recordCounts": { "type": "object", "additionalProperties": { "type": "integer", "minimum": 0 } },
        "slaImpact": { "type": ["string", "null"] }
      }
    },
    "timelineEvent": {
      "type": "object",
      "required": ["id", "timestamp", "actor", "source", "category", "description", "confidence"],
      "additionalProperties": false,
      "properties": {
        "id": { "type": "string" },
        "timestamp": { "type": "string", "format": "date-time" },
        "timezone": { "type": "string" },
        "actor": { "$ref": "#/$defs/actor" },
        "source": { "type": "string" },
        "system": { "type": "string" },
        "category": { "type": "string" },
        "severity": { "type": "string", "enum": ["info", "low", "medium", "high", "critical"] },
        "description": { "type": "string" },
        "evidenceRefs": { "type": "array", "items": { "type": "string" }, "default": [] },
        "visibility": { "type": "string", "enum": ["internal", "executive", "customer", "regulator", "legal"], "default": "internal" },
        "automation": { "type": "boolean", "default": false },
        "confidence": { "type": "string", "enum": ["low", "medium", "high", "confirmed"] },
        "correlatedEventIds": { "type": "array", "items": { "type": "string" }, "default": [] }
      }
    },
    "evidenceItem": {
      "type": "object",
      "required": ["id", "category", "description", "source", "collector", "collectedAt", "confidentiality", "integrityStatus", "retentionPolicy"],
      "additionalProperties": false,
      "properties": {
        "id": { "type": "string" },
        "category": { "type": "string" },
        "description": { "type": "string" },
        "source": { "type": "string" },
        "collector": { "$ref": "#/$defs/actor" },
        "collectedAt": { "type": "string", "format": "date-time" },
        "observedAt": { "type": ["string", "null"], "format": "date-time" },
        "timezone": { "type": "string" },
        "sha256": { "type": ["string", "null"], "pattern": "^[a-fA-F0-9]{64}$" },
        "fileSizeBytes": { "type": ["integer", "null"], "minimum": 0 },
        "mimeType": { "type": ["string", "null"] },
        "confidentiality": { "type": "string", "enum": ["public", "internal", "confidential", "restricted", "privileged"] },
        "integrityStatus": { "type": "string", "enum": ["unverified", "verified", "hash_mismatch", "superseded"] },
        "chainOfCustody": { "type": "array", "items": { "$ref": "#/$defs/custodyEvent" }, "default": [] },
        "relatedSystems": { "type": "array", "items": { "type": "string" }, "default": [] },
        "relatedUsers": { "type": "array", "items": { "type": "string" }, "default": [] },
        "relatedTimelineEvents": { "type": "array", "items": { "type": "string" }, "default": [] },
        "tags": { "type": "array", "items": { "type": "string" }, "default": [] },
        "retentionPolicy": { "$ref": "#/$defs/retentionPolicy" },
        "immutable": { "type": "boolean", "default": true },
        "version": { "type": "integer", "minimum": 1, "default": 1 },
        "uri": { "type": ["string", "null"] }
      }
    },
    "impactAssessment": {
      "type": "object",
      "required": ["category", "severity", "confidence", "narrative"],
      "additionalProperties": false,
      "properties": {
        "category": { "type": "string" },
        "severity": { "type": "string", "enum": ["none", "low", "medium", "high", "critical"] },
        "confidence": { "type": "string", "enum": ["low", "medium", "high", "confirmed"] },
        "narrative": { "type": "string" },
        "metrics": { "type": "object", "additionalProperties": true },
        "estimatedCost": { "type": ["number", "null"], "minimum": 0 },
        "customerCount": { "type": ["integer", "null"], "minimum": 0 },
        "affectedRecords": { "type": ["integer", "null"], "minimum": 0 },
        "evidenceRefs": { "type": "array", "items": { "type": "string" }, "default": [] }
      }
    },
    "communication": {
      "type": "object",
      "required": ["id", "audience", "channel", "status", "createdAt", "body"],
      "additionalProperties": false,
      "properties": {
        "id": { "type": "string" },
        "audience": { "type": "string", "enum": ["internal", "executive", "customer", "status_page", "regulator", "support", "vendor"] },
        "channel": { "type": "string" },
        "status": { "type": "string", "enum": ["draft", "approved", "sent", "scheduled", "canceled"] },
        "createdAt": { "type": "string", "format": "date-time" },
        "sentAt": { "type": ["string", "null"], "format": "date-time" },
        "approvals": { "type": "array", "items": { "$ref": "#/$defs/approval" }, "default": [] },
        "subject": { "type": ["string", "null"] },
        "body": { "type": "string" },
        "externalRefs": { "type": "array", "items": { "$ref": "#/$defs/linkRef" }, "default": [] }
      }
    },
    "decision": {
      "type": "object",
      "required": ["id", "timestamp", "maker", "decision", "rationale"],
      "properties": {
        "id": { "type": "string" },
        "timestamp": { "type": "string", "format": "date-time" },
        "maker": { "$ref": "#/$defs/actor" },
        "decision": { "type": "string" },
        "rationale": { "type": "string" },
        "alternatives": { "type": "array", "items": { "type": "string" } },
        "evidenceRefs": { "type": "array", "items": { "type": "string" } }
      }
    },
    "actionItem": {
      "type": "object",
      "required": ["id", "title", "owner", "priority", "status", "verificationMethod"],
      "properties": {
        "id": { "type": "string" },
        "title": { "type": "string" },
        "description": { "type": "string" },
        "owner": { "$ref": "#/$defs/actor" },
        "priority": { "type": "string", "enum": ["P0", "P1", "P2", "P3", "P4"] },
        "status": { "type": "string", "enum": ["proposed", "accepted", "in_progress", "blocked", "complete", "verified", "canceled"] },
        "dueDate": { "type": ["string", "null"], "format": "date" },
        "dependencies": { "type": "array", "items": { "type": "string" } },
        "estimatedEffort": { "type": ["string", "null"] },
        "riskReduction": { "type": ["string", "null"] },
        "verificationMethod": { "type": "string" },
        "completionEvidenceRefs": { "type": "array", "items": { "type": "string" } }
      }
    },
    "rca": {
      "type": "object",
      "properties": {
        "summary": { "type": "string" },
        "methodsUsed": { "type": "array", "items": { "type": "string" } },
        "rootCauses": { "type": "array", "items": { "$ref": "#/$defs/rcaFinding" } },
        "contributingFactors": { "type": "array", "items": { "$ref": "#/$defs/rcaFinding" } },
        "detectionGaps": { "type": "array", "items": { "$ref": "#/$defs/rcaFinding" } },
        "monitoringGaps": { "type": "array", "items": { "$ref": "#/$defs/rcaFinding" } },
        "documentationGaps": { "type": "array", "items": { "$ref": "#/$defs/rcaFinding" } }
      }
    },
    "rcaFinding": {
      "type": "object",
      "required": ["id", "type", "description"],
      "properties": {
        "id": { "type": "string" },
        "type": { "type": "string" },
        "description": { "type": "string" },
        "evidenceRefs": { "type": "array", "items": { "type": "string" } },
        "actionRefs": { "type": "array", "items": { "type": "string" } }
      }
    },
    "securityExtension": {
      "type": "object",
      "additionalProperties": true,
      "properties": {
        "attackVector": { "type": ["string", "null"] },
        "threatActor": { "type": ["string", "null"] },
        "mitreAttack": { "type": "array", "items": { "$ref": "#/$defs/mitreMapping" } },
        "mitreD3fend": { "type": "array", "items": { "$ref": "#/$defs/mitreMapping" } },
        "iocs": { "type": "array", "items": { "$ref": "#/$defs/indicator" } },
        "exfiltrationAssessment": { "type": ["string", "null"] },
        "compromisedAccounts": { "type": "array", "items": { "type": "string" } },
        "notifications": { "type": "array", "items": { "$ref": "#/$defs/communication" } }
      }
    },
    "reliabilityExtension": {
      "type": "object",
      "additionalProperties": true,
      "properties": {
        "availability": { "type": ["number", "null"] },
        "latency": { "type": "object", "additionalProperties": true },
        "errorRate": { "type": "object", "additionalProperties": true },
        "traffic": { "type": "object", "additionalProperties": true },
        "capacity": { "type": "object", "additionalProperties": true },
        "slo": { "type": "object", "additionalProperties": true },
        "deployment": { "type": "object", "additionalProperties": true },
        "rollback": { "type": "object", "additionalProperties": true }
      }
    },
    "regulatoryExtension": {
      "type": "object",
      "properties": {
        "possibleNotificationRequired": { "type": "boolean", "default": false },
        "frameworks": { "type": "array", "items": { "type": "string" } },
        "jurisdictions": { "type": "array", "items": { "type": "string" } },
        "assessment": { "type": "string" },
        "deadlines": { "type": "array", "items": { "$ref": "#/$defs/regulatoryDeadline" } }
      }
    },
    "audit": {
      "type": "object",
      "required": ["createdBy", "version"],
      "properties": {
        "createdBy": { "$ref": "#/$defs/actor" },
        "version": { "type": "integer", "minimum": 1 },
        "legalHold": { "type": "boolean", "default": false },
        "auditEvents": { "type": "array", "items": { "$ref": "#/$defs/auditEvent" }, "default": [] }
      }
    },
    "actor": {
      "type": "object",
      "required": ["type", "name"],
      "properties": {
        "type": { "type": "string", "enum": ["user", "team", "system", "vendor", "automation"] },
        "id": { "type": ["string", "null"] },
        "name": { "type": "string" },
        "email": { "type": ["string", "null"], "format": "email" }
      }
    },
    "attachment": {
      "type": "object",
      "required": ["id", "category", "name", "uri"],
      "properties": {
        "id": { "type": "string" },
        "category": { "type": "string" },
        "name": { "type": "string" },
        "uri": { "type": "string" },
        "sha256": { "type": ["string", "null"] },
        "mimeType": { "type": ["string", "null"] },
        "fileSizeBytes": { "type": ["integer", "null"] }
      }
    },
    "lifecycleTransition": {
      "type": "object",
      "required": ["timestamp", "actor", "from", "to", "reason"],
      "properties": {
        "timestamp": { "type": "string", "format": "date-time" },
        "actor": { "$ref": "#/$defs/actor" },
        "from": { "$ref": "#/$defs/lifecycleState" },
        "to": { "$ref": "#/$defs/lifecycleState" },
        "reason": { "type": "string" },
        "evidenceRefs": { "type": "array", "items": { "type": "string" } }
      }
    },
    "custodyEvent": {
      "type": "object",
      "required": ["timestamp", "actor", "action"],
      "properties": {
        "timestamp": { "type": "string", "format": "date-time" },
        "actor": { "$ref": "#/$defs/actor" },
        "action": { "type": "string" },
        "notes": { "type": "string" }
      }
    },
    "retentionPolicy": {
      "type": "object",
      "required": ["policyId", "retainUntil"],
      "properties": {
        "policyId": { "type": "string" },
        "retainUntil": { "type": "string", "format": "date" },
        "legalHold": { "type": "boolean", "default": false }
      }
    },
    "approval": {
      "type": "object",
      "required": ["approver", "status", "timestamp"],
      "properties": {
        "approver": { "$ref": "#/$defs/actor" },
        "status": { "type": "string", "enum": ["requested", "approved", "rejected"] },
        "timestamp": { "type": "string", "format": "date-time" },
        "notes": { "type": "string" }
      }
    },
    "auditEvent": {
      "type": "object",
      "required": ["id", "timestamp", "actor", "action"],
      "properties": {
        "id": { "type": "string" },
        "timestamp": { "type": "string", "format": "date-time" },
        "actor": { "$ref": "#/$defs/actor" },
        "action": { "type": "string" },
        "objectType": { "type": "string" },
        "objectId": { "type": "string" },
        "metadata": { "type": "object", "additionalProperties": true }
      }
    },
    "indicator": {
      "type": "object",
      "required": ["type", "value"],
      "properties": {
        "type": { "type": "string" },
        "value": { "type": "string" },
        "confidence": { "type": "string" },
        "firstSeen": { "type": ["string", "null"], "format": "date-time" },
        "lastSeen": { "type": ["string", "null"], "format": "date-time" }
      }
    },
    "mitreMapping": {
      "type": "object",
      "required": ["id", "name"],
      "properties": {
        "id": { "type": "string" },
        "name": { "type": "string" },
        "tactic": { "type": ["string", "null"] },
        "confidence": { "type": "string" }
      }
    },
    "regulatoryDeadline": {
      "type": "object",
      "required": ["framework", "deadlineAt"],
      "properties": {
        "framework": { "type": "string" },
        "deadlineAt": { "type": "string", "format": "date-time" },
        "status": { "type": "string" }
      }
    },
    "linkRef": {
      "type": "object",
      "required": ["label", "url"],
      "properties": {
        "label": { "type": "string" },
        "url": { "type": "string", "format": "uri" }
      }
    }
  }
}