Română
Português
EspañolIncidents and the NIS2 reporting clock
When something serious happens, two things matter: understanding it quickly, and telling the authority on time if the law requires it. The portal helps with both; the decision and the report are yours.
The first hour
- Detect
A high or critical alert
It appears on the Overview, in the live stream and in Events. Every alert carries its MITRE ATT&CK technique and the frameworks it touches.
- Scope
Which machines, which accounts
Open the event: its source address shows every other host it reached in the last 30 days. Topology shows what that host exposes.
- Contain
Act on the systems
Block the address, disable the account, isolate the machine — on your systems. The portal reads; it does not change your servers.
- Record
Keep the evidence
Export the events (CSV or JSON) as they are. The audit trail records who looked at what in the portal.
The NIS2 Article 23 clock
If your organisation is an essential or important entity under NIS2, a significant incident must be reported to your CSIRT or competent authority in stages:
| Deadline | What is due | Content |
|---|---|---|
| 24 hours | Early warning | Whether it is suspected to be unlawful or malicious, and whether it could have a cross-border impact. |
| 72 hours | Incident notification | Updates the early warning: an initial assessment of severity and impact, and indicators of compromise. |
| On request | Intermediate report | Status updates the authority asks for. |
| 1 month | Final report | Detailed description, the type of threat or root cause, mitigation applied, cross-border impact. |
The Compliance screen keeps this clock: from the first high or critical detection it shows the three deadlines running, and "Quiet" when there is nothing to report. Drafting starts from the security report for the period.
What makes an incident significant, and the thresholds the Implementing Regulation sets for digital providers, are explained in the NIS2 guide.
Related
Still stuck?
Write to us with what you tried and what you saw. A person answers, in writing, on business days.