Breach Management

Overview

Neostra's Breach Management module provides a structured approach to handling data breach incidents from initial reporting through resolution. It includes configurable intake forms, incident classification by breach type, and workflow-driven response processes powered by the same workflow engine used for DSAR handling.

Breach Response Workflow

Breach incidents move through configurable workflow stages powered by the same engine used for DSAR management. Each stage can include assigned tasks, approvals, and notifications.

Intake Forms

Breach intake forms define the structure for incident reporting. Forms support versioning with a publish lifecycle so you can iterate on form design without affecting active incidents.

curl -X POST https://api.neostra.io/v1/breach-intake-forms \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Standard Breach Report Form",
    "description": "Default intake form for all breach incidents"
  }'

curl -X PUT https://api.neostra.io/v1/breach-intake-forms/{formId}/fields \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": [
      {
        "label": "Incident Date",
        "type": "DATE",
        "required": true
      },
      {
        "label": "Description of Incident",
        "type": "TEXTAREA",
        "required": true
      },
      {
        "label": "Estimated Number of Affected Individuals",
        "type": "NUMBER",
        "required": false
      },
      {
        "label": "Data Categories Involved",
        "type": "MULTI_SELECT",
        "options": ["Personal", "Financial", "Health", "Biometric", "Children"],
        "required": true
      },
      {
        "label": "Breach Type",
        "type": "BREACH_TYPE_SELECT",
        "required": true
      }
    ]
  }'

curl -X POST https://api.neostra.io/v1/breach-intake-forms/{formId}/publish \
  -H "Authorization: Bearer <token>"

Form Versioning

Breach Types

Breach types provide a classification system for categorizing incidents. Configure types to match your organization's incident taxonomy.

curl -X POST https://api.neostra.io/v1/breach-types \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Unauthorized Access",
    "description": "Unauthorized individual gained access to personal data"
  }'

curl -X GET https://api.neostra.io/v1/breach-types \
  -H "Authorization: Bearer <token>"

curl -X PUT https://api.neostra.io/v1/breach-types/{typeId} \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Unauthorized Access",
    "description": "Updated description for unauthorized access incidents"
  }'

curl -X DELETE https://api.neostra.io/v1/breach-types/{typeId} \
  -H "Authorization: Bearer <token>"

Breach Incidents

Incidents are created when a breach intake form is submitted and then move through the configured workflow stages.

curl -X POST https://api.neostra.io/v1/breach-incidents \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "formId": "form_001",
    "breachTypeId": "type_unauthorized_access",
    "responses": {
      "incident_date": "2026-03-10",
      "description": "Unauthorized access to customer database detected via anomalous query patterns.",
      "estimated_affected": 1500,
      "data_categories": ["Personal", "Financial"]
    }
  }'

curl -X GET https://api.neostra.io/v1/breach-incidents \
  -H "Authorization: Bearer <token>"

curl -X GET https://api.neostra.io/v1/breach-incidents/{incidentId} \
  -H "Authorization: Bearer <token>"

curl -X POST https://api.neostra.io/v1/breach-incidents/{incidentId}/transitions \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "targetStage": "INVESTIGATING",
    "notes": "Investigation team assigned. Initial review indicates SQL injection vector."
  }'

Key API Endpoints

Permissions

Integration with Workflow Engine

Regulatory Notification Timelines

When a breach meets regulatory thresholds, organizations must comply with jurisdiction-specific notification requirements. Neostra automatically calculates applicable timelines based on the geographic scope of the breach.

Severity Scoring

Neostra uses a severity scoring mechanism to classify breach incidents and determine appropriate response timelines. Scores are generated based on the category of personal data involved in the breach.

Stakeholder Notification

When a breach is created, Neostra automatically identifies required stakeholders and generates notification tasks within the breach workflow.

Breach Terminology Reference