Incident Management

Article 23 compliant tracking, notification, and response.

Active Incidents

Reports Pending

Mean Time to Notify

2.4h

▼12%

Notification Timeline: Current Incident

SIGNIFICANT IMPACT

T + 24 Hours

Early Warning

Submission of initial notification to CSIRT or competent authority.

T + 72 Hours

Incident Notification

Updated report focusing on severity, impact, and indicators of compromise.

T + 1 Month

Final Report

Detailed analysis of root cause and prevention measures implemented.

Incident History

Ref ID	Detection Date	Type	Status	NIS2 Phase
INC-2026-42	2026-03-14 09:12	Signaling DDoS	In Progress	72h Notification Pending
INC-2026-12	2026-02-10 14:00	Malware Infiltration	Closed	Final Report Submitted
INC-2025-98	2025-11-22 03:45	SIM Swapping Surge	Closed	Final Report Submitted

Article 23.3 Cross-Border Telecom Impact Assessor

Evaluates Mandatory Reporting to Impacted EU Member State CSIRTs

Primary Affected Network Domain

Estimated Outbound Roaming / Transit Impact

NIS2 Article 23.3 Status

🚨 Mandatory Cross-Border CSIRT Notice Required

The incident affects essential international telecom gateways with >10,000 roaming subscribers or multiple EU Member States. You must notify ENISA CyCLONe and affected Member State CSIRTs within 24h.

Action Required: Dispatch STIX 2.1 Threat Bundle to CSIRT CyCLONe Network.

CSIRT & National Regulator Incident Exporter

NIS2 Article 23 Standardized STIX 2.1 & EU CSIRT JSON Reporting

Incident Parameters

Reporting Phase

Incident Name / Title

Suspected Attack Pattern / Vector

Indicator of Compromise (IoC)

Suspected Cross-Border Impact on EU Telecom Peers

STIX 2.1 Threat Intelligence Bundle

{
  "type": "bundle",
  "id": "bundle--j6jganrjm",
  "spec_version": "2.1",
  "objects": [
    {
      "type": "identity",
      "id": "identity--telcosec-operator",
      "name": "TelcoSec Telecom Essential Entity",
      "identity_class": "organization",
      "sectors": [
        "telecommunications"
      ]
    },
    {
      "type": "incident",
      "id": "incident--xbrdj95gt",
      "created": "2026-07-28T01:31:24.515Z",
      "modified": "2026-07-28T01:31:24.515Z",
      "name": "5G Core Control Plane Signaling Anomaly",
      "description": "NIS2 Article 23 incident report during phase 24h_early_warning",
      "labels": [
        "nis2-directive",
        "telecom-essential-entity",
        "SS7_DIAMETER_EXPLOIT"
      ]
    },
    {
      "type": "indicator",
      "id": "indicator--qb5b736gy",
      "created": "2026-07-28T01:31:24.515Z",
      "modified": "2026-07-28T01:31:24.515Z",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "valid_from": "2026-07-28T01:31:24.515Z"
    }
  ]
}