`maqpna incident export`

Export a verified incident timeline from the audit ledger for a 6-hour (CERT-In) report

Observe-o json | yaml

Synopsis#

maqpna incident export [FILE] [--gateway URL] [--since 6h] [--until RFC3339] [-n NS] [--session S] [--agent A]
                       [--all] [--detected RFC3339] [--format json|md] [--out FILE]

Description#

From the help of maqpna incident:

Builds an incident timeline from the hash-chained audit ledger: a local FILE (e.g. one fetched with "maqpna audit fetch ledger"), or the live gateway (--gateway / MAQPNA_GATEWAY_URL, auditor token). The chain is verified over the exported window. Notable events are denials, approvals, admin operations (kill switch, revocations, vault), DLP and taint hits; --all adds allowed calls.

--detected sets when the incident was noticed (default: now); the document then states the CERT-In reporting deadline (detected + 6h). Times are UTC from the ledger; the gateway's clock must be synchronised (CERT-In: NTP to the NIC / NPL servers, see the Cloud profiles docs).

This is a fact sheet from the ledger to help fill in a report, not legal advice and not a filed report.

Flags#

Flag	Type	Description	Default
`--agent`	string	only this agent	none
`--all`	switch	include allowed calls, not only notable events	none
`--allow-gateway-mismatch`	switch	send the context's login token to a gateway other than the one it was issued for (env MAQPNA_ALLOW_GATEWAY_MISMATCH=1)	none
`--detected`	string	when the incident was noticed (RFC3339; default now)	none
`--format`	string	json (machine-readable) or md (a report draft)	`json`
`--gateway`	string	gateway base URL (env MAQPNA_GATEWAY_URL; default: the context's gateway)	none
`-n`, `--namespace`	string	only this namespace	none
`--oidc-token-file`	string	file holding an OIDC access token for the admin API (env MAQPNA_OIDC_TOKEN_FILE); wins over `--token`	none
`--out`	string	write to FILE (0600) instead of stdout	none
`--session`	string	only this session	none
`--since`	string	window start: a duration ago (6h) or an RFC3339 time	`6h`
`--token`	string	static admin token (env MAQPNA_ADMIN_TOKEN; dev/break-glass)	none
`--until`	string	window end (exclusive), RFC3339; default now	none

The global flags (--context, -o, --no-color, ...) work with every command.

Examples#

$ maqpna incident export --gateway "$GW" --since 6h --format md --out incident.md
$ maqpna incident export audit.jsonl --since 2026-10-10T02:00:00Z --until 2026-10-10T08:00:00Z -n team-a
$ maqpna incident export --gateway "$GW" --since 24h --detected 2026-10-10T07:45:00Z --all -o json

What happens when you run it#

Talks to the gateway: --gateway, else MAQPNA_GATEWAY_URL, else the current context's gateway (maqpna context).
Authenticates to the admin API with the token stored by maqpna login, --oidc-token-file, or a static --token (MAQPNA_ADMIN_TOKEN).
Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

maqpna incident export