NKCKI: Submit notifications

Contents

• Overview
• Submission sequence
  • Step 1. Prepare the incident
  • Step 2. Complete the card
    • 1. Event details
    • 2. Organization details
    • 3. Controlled resource details
    • 4. Technical details
    • 5. Personal data leak
    • 6. Internal event
  • Step 3. Submit the notification
  • Step 4. Verify the result
    • 1. Verify the incident card
    • 2. Verify the notification in the account
• Submit additions
• Required fields
• Value formats
• Submission errors

---

Overview

This article explains how to submit notifications to the NKCKI personal account (the account) from Incident Manager. Validation errors are shown in Russian by the integration; the English text below is provided for reference.

For notification types and workflow states, see NKCKI Integration. For installation and configuration, see NKCKI: Installation and configuration.

---

Submission sequence

Step 1. Prepare the incident

Open the incident in Incident Manager. It must have the NKCKI type and workflow. Tasks configured as described in NKCKI: Installation and configuration create incidents with these settings. You can also create an incident manually and select the NKCKI type and workflow.

Trigger the Take ownership transition.

Step 2. Complete the card

Notification fields are located in the Incident Details section of the incident card. Some fields are populated with default values specified during installation and data from the task that created the incident. Verify these values and complete the remaining fields. For required fields by notification type, see Required fields; for value formats, see Value formats.

1. Event details

• Notification category - CI, CA, or internal event. The default is Computer incident notification
• CI/CA type - select a type from the list. The list includes CI and CA types; select the one that matches the notification category
• Brief description of the information security event
• Information about the incident detection tool or method
• Incident detection date and time - defaults to the time of the event that created the incident
• Incident end date and time
• Response status - CI only. The default is Response measures in progress
• Involvement of FSB forces - defaults to No
• Restriction marker TLP - defaults to TLP:AMBER
• Availability impact, Integrity impact, Confidentiality impact, Brief description of another form of computer incident consequences - CI only

2. Organization details

Default values are specified during installation. Verify and update them if necessary:

• MSSP organization - required for submissions through an MSSP and for an internal event
• Short name of the information resource owner organization
• Full name of the information resource owner organization
• TIN, TRRC, PSRN
• Response forces involved - organization name from the GosSOPKA website list, or an indication that no third-party organizations are required

3. Controlled resource details

• Controlled resource name
• Categorization information - CII facility category
• Entity area of operation
• Internet connectivity - Yes or No. No default value is set
• Location - region code in ISO 3166-2 format
• Locality or geographic coordinates

4. Technical details

Complete these fields if Internet connectivity is set to Yes. At least one value is required. Enter each value on a separate line.

Attacked asset details:

• Attacked asset. IPv4, Attacked asset. IPv6
• Attacked asset. Domain name, Attacked asset. URI address
• Attacked resource email address
• Attacked asset. Network service name and port/protocol - use the <name>|<port>/<protocol> format, for example https|443/TCP
• Attacked asset. AS-Path

Attack source details:

• Attack source. Function - function applied to indicator entries that do not specify a function
• Attack source. IPv4, Attack source. IPv6, Attack source. Domain name, Attack source. URI address - use the <function>|<value> or <value> format if the function is selected in Attack source. Function
• Attack source. Email address - address without a function
• Malicious module hash - MD5, SHA-1, SHA-256, or SHA-512 in hexadecimal format
• Description of vulnerabilities used
• Attack source. ASN, Attack source. AS, Attack source. LIR

Allowed attack source functions: Malware control center, Malware infrastructure element, Malware distribution source, Type not defined. Example value for Attack source. IPv4:

Malware control center|203.0.113.10
Type not defined|198.51.100.25

5. Personal data leak

Complete this section for CI notifications only. Set Personal data leak to Yes and complete these fields:

• Personal data operator address
• Email for personal data leak notification information
• Presumed causes of personal data subject rights violation
• Personal data characteristics
• Presumed harm to personal data subjects
• Measures taken to mitigate the leak consequences, Additional information about the personal data leak, Internal investigation results - optional fields

If Personal data leak is set to No, leave the fields in this section empty.

6. Internal event

Complete this section for the Internal event notification category:

• Internal event executor - name of the GosSOPKA center responsible for the event
• Brief description of the internal event
• Event start date and time
• Event end date and time - optional field
• Executor resource. IPv4, Executor resource. IPv6, Executor resource. Domain, Executor resource. Email - optional fields

Save the incident card.

Step 3. Submit the notification

Trigger the Submit information to NKCKI transition as described in Edit incidents. The transition starts the Submit incident to NKCKI active action.

You can also start the action manually from the incident's Active Actions menu, as described in Active Actions.

The action runs for one incident at a time. If field validation fails, the action notification displays the error text and the incident moves to the Submission error state. Correct the fields and trigger Retry submission to NKCKI.

Step 4. Verify the result

1. Verify the incident card

After successful submission:

• the incident is in the Information submitted to NKCKI state
• the NKCKI account notification UUID, NKCKI account notification ID, and NKCKI account notification registration number fields are populated
• the incident history contains a record of the active action execution

Only the action populates the ID fields; they cannot be edited.

2. Verify the notification in the account

Find the notification in the account using the ID or registration number from the card and verify the submitted information.

---

Submit additions

An addition submits changes to an already registered CI or CA notification. To submit an addition:

1. Update the fields in the card that are submitted as part of an addition:

   Field	CI addition	CA addition
   Incident end date and time	Submitted	Submitted
   Information about the incident detection tool or method	Submitted	Submitted
   Brief description of the information security event	Submitted	Submitted
   Locality or geographic coordinates	Submitted	Submitted
   Response status	Submitted	Not submitted
   Availability impact, Integrity impact, Confidentiality impact	Submitted	Not submitted
   Brief description of another form of computer incident consequences	Submitted	Not submitted
   Account notification status for addition	Submitted if populated	Added automatically

2. Save the incident card

3. Trigger the Submit additions to NKCKI transition

The addition is sent to the notification identified by NKCKI account notification UUID in the card. Changes to other fields are not included in the addition.

Information

Resubmitting an addition without changing the fields included in it is blocked. Internal event notifications cannot be amended after registration.

---

Required fields

The required fields depend on the notification type:

Field	CI	CI with personal data leak	CA	Internal event
Notification category	Yes	Yes	Yes	Yes
CI/CA type	Yes	Yes	Yes	No
MSSP organization	MSSP mode	MSSP mode	MSSP mode	Yes
Short name of the information resource owner organization	Yes	Yes	Yes	Yes
Full name of the information resource owner organization	Yes	Yes	Yes	Yes
TIN, TRRC, PSRN	Yes	Yes	Yes	Yes
Response forces involved	Yes	Yes	Yes	No
Involvement of FSB forces	Yes	Yes	Yes	No
Brief description of the information security event	Yes	Yes	Yes	No
Restriction marker TLP	Yes	Yes	Yes	No
Incident detection date and time	Yes	Yes	Yes	No
Response status	Yes	Yes	No	No
Controlled resource name	Yes	Yes	Yes	No
Categorization information	Yes	Yes	Yes	No
Entity area of operation	Yes	Yes	Yes	No
Internet connectivity	Yes	Yes	Yes	No
Location	Yes	Yes	Yes	No
Technical details	Required if Internet connectivity is enabled	Required if Internet connectivity is enabled	Required if Internet connectivity is enabled	No
Personal data leak and the required fields in Personal data leak	No	Yes	No	No
Internal event executor	No	No	No	Yes
Brief description of the internal event	No	No	No	Yes
Event start date and time	No	No	No	Yes

“Yes” means the field is required; “No” means it is optional or is not submitted for this notification type; “MSSP mode” means the field is required when submission is configured for an MSSP organization.

---

Value formats

Value	Format
TIN	10 or 12 digits, no spaces
TRRC	9 digits, no spaces
PSRN	13 or 15 digits, no spaces
Location	Region code in ISO 3166-2 format, for example RU-KYA or RU-SAM. The account validates that the code exists
Date and time	YYYY-MM-DDThh:mm:ss with a time zone, for example 2026-10-21T09:30:00Z or 2026-10-21T12:30:00+03:00. A time without a time zone is treated as UTC
Incident detection date and time, Incident end date and time	Must not be later than the current time. The end date must not be earlier than the detection date
Event end date and time	Must not be earlier than the event start date
IPv4, IPv6	Address in the corresponding protocol version
Domain name	Fully qualified domain name, for example example.ru
URI	URI with a scheme, for example https://example.ru/path
Email address	<name>@<domain>
Network service	<name>|<port>/<protocol>, port from 1 to 65535
Text fields	Up to 5,000 characters. For fields with multiple values, the combined length must not exceed 5,000 characters
Attack source indicators in a CA notification	No more than 30 values in total

---

Submission errors

If an error occurs, the incident moves to the Submission error state. The error appears in the action notification and on the NKCKI Incidents dashboard. In error messages, “Field name” is replaced with the incident card field name.

Error	Cause and action
“Field name”: field is empty.	A required field is empty. Complete it and retry submission
“Field name”: invalid value “...”.	The value is not allowed for the selected category; for example, a CA type was selected for a CI notification. Select a valid value
“Field name”: 10 or 12 digits are required, without spaces.	Invalid TIN, TRRC, or PSRN format
“Field name”: invalid date or the detection/end date is in the future.	Invalid date format or a date later than the current time. See Value formats
“Field name”, row N: invalid value format or attack source function.	A value in row N has an invalid format, or an attack source function is missing for an indicator
Technical details are populated, but Internet connectivity is not set to Yes.	Set Internet connectivity to Yes or clear the technical details
Internet connectivity is set to Yes: provide technical details about the resource or attack source.	Complete at least one field in Technical details
Personal data leak details are populated: set the leak indicator to Yes or clear these fields.	The fields in Personal data leak are populated while the value is No
Personal data leak information is supported only for CI.	The leak indicator is set for a CA. Change the category or the indicator
Region: an ISO 3166-2 code in the RU-KYA format is required...	Specify a region code, for example RU-KYA
Technical details about attack sources: no more than 30 indicators are allowed in total...	Reduce the number of indicators in the CA notification
Resubmission is prohibited: addition data has not changed since the last successful submission to NKCKI.	The addition fields are unchanged. Update the information or do not submit the addition
The internal event has already been registered...	Additions to internal events are not supported
Bulk submission is disabled. Select one incident.	The action was started for multiple incidents. Start it for a single incident
The action applies only to an incident.	The action was started for an aggregation. Start it from an incident card
NKCKI returned HTTP “code”: ...	The account rejected the notification. Check the account response and card details
Connection error to the NKCKI API: ...	No connection to the account. Ask an administrator to check network access and connection settings as described in NKCKI: Installation and configuration
NKCKI returned an invalid success response.	The account returned success, but the response contains no notification IDs. The submission result is unknown: check whether the notification was registered in the account and do not retry until verified
Submission was already attempted or its result requires manual verification (audit-lock exists).	An initial submission was already attempted for this incident. See below

Warning

Before the initial submission, the action creates a duplicate-submission lock for the incident in the sm-nkcki-exchange index. The lock remains even if the account or connection returns an error, so another initial submission for the same incident fails because an audit-lock already exists. This prevents duplicate notification registration.

Check whether the notification was registered in the account. If it was not, ask a Smart Monitor administrator to remove the incident lock from the sm-nkcki-exchange index.