NKCKI Integration

Contents

• Overview
• How the integration works
• Notification types
• NKCKI workflow
• Package contents
• Limitations
• Articles in this section

---

Overview

The National Coordination Center for Computer Incidents (NKCKI) receives information about computer incidents and computer attacks through the GosSOPKA personal account (the account).

The integration lets you submit this information to the account directly from Incident Manager. The operator fills in the notification fields in the incident card and starts submission by triggering a workflow transition. After submission, the notification IDs assigned by the account are added to the card.

Organization details that recur in every notification (legal name, INN, KPP, OGRN, whether a facility is part of critical information infrastructure (CII), area of operation, and region) are specified once during installation and populated in each new card.

---

How the integration works

1. A Job Scheduler task creates an incident with the NKCKI type and workflow. Some notification fields are populated with default values and event data
2. The operator takes ownership of the incident and fills in the missing information in the card
3. The Submit information to NKCKI transition starts the Submit incident to NKCKI active action
4. The action determines the notification type from the card fields, validates required fields and value formats, and submits the notification to the account
5. The account response is added to the card, and the incident moves to the Information submitted to NKCKI state. If an error occurs, the incident moves to the Submission error state
6. Each submission attempt is recorded in the sm-nkcki-exchange index, and the NKCKI Incidents dashboard shows incident states and submission errors

Updates to information in a registered notification are submitted to the account as additions from the same card.

---

Notification types

The notification type is determined automatically from the card fields:

Condition	Notification type
Notification category is Computer incident notification; Personal data leak is No	Computer incident notification (CI)
Notification category is Computer incident notification; Personal data leak is Yes	CI notification with personal data leak information
Notification category is Computer attack notification	Computer attack notification (CA)
Notification category is Internal event notification	Internal event notification
The card contains NKCKI account notification UUID	Addition to a CI or CA notification

For CI and CA notifications, the Internet connectivity field determines whether technical information about the attacked asset and attack source is submitted. If the value is Yes, this information is required; if it is No, it must not be provided.

---

NKCKI workflow

State	Transition	Result
New incident	Take ownership	State changes to In progress
In progress	Submit information to NKCKI	Submits the notification. State changes to Information submitted to NKCKI or Submission error
Information submitted to NKCKI	Submit additions to NKCKI	Submits an addition to the registered notification
Information submitted to NKCKI	Close incident	State changes to Incident closed
Submission error	Retry submission to NKCKI	Resubmits the notification
Submission error	Return to work	State changes to In progress

For details about workflows, see Workflow.

---

Package contents

Component	Purpose
Installation utility	Creates incident fields, the NKCKI incident type, the Submit incident to NKCKI active action, the NKCKI workflow, and the NKCKI Incidents dashboard in Smart Monitor
Active action script	Validates card fields, submits the notification to the account, and records the result in the card
Connection settings example	Template for connection settings to the account and Smart Monitor

For installation steps, see NKCKI: Installation and configuration.

---

Limitations

• one incident is submitted per run; bulk submission is disabled
• personal data leak information is submitted only in a CI notification
• additions can be submitted only for CI and CA notifications. An internal event cannot be amended after registration
• a CA notification with Internet connectivity can contain no more than 30 attack source indicators in total; indicator files are not supported
• the action does not retrieve notification state changes from the account; the card stores only the account's submission response
• the installation utility does not modify Job Scheduler tasks; task assignment is manual

---

Articles in this section

NKCKI: Installation and configuration

Install and configure the Incident Manager active action for submitting computer incident and attack notifications to the NKCKI personal account.

NKCKI: Submit notifications

Instructions for completing an incident card, submitting an NKCKI notification, sending additions, and troubleshooting submission errors.