`maqpna incident`

Export an incident timeline from the audit ledger (CERT-In 6-hour reporting)

Observe-o json | yaml

Synopsis#

maqpna incident export [FILE] [--gateway URL] [--since 6h] [--until RFC3339] [-n NS] [--session S] [--agent A]
                       [--all] [--detected RFC3339] [--format json|md] [--out FILE]

Description#

Builds an incident timeline from the hash-chained audit ledger: a local FILE (e.g. one fetched with "maqpna audit fetch ledger"), or the live gateway (--gateway / MAQPNA_GATEWAY_URL, auditor token). The chain is verified over the exported window. Notable events are denials, approvals, admin operations (kill switch, revocations, vault), DLP and taint hits; --all adds allowed calls.

--detected sets when the incident was noticed (default: now); the document then states the CERT-In reporting deadline (detected + 6h). Times are UTC from the ledger; the gateway's clock must be synchronised (CERT-In: NTP to the NIC / NPL servers, see the Cloud profiles docs).

This is a fact sheet from the ledger to help fill in a report, not legal advice and not a filed report.

Subcommands#

maqpna incident exportExport a verified incident timeline from the audit ledger for a 6-hour (CERT-In) report

Examples#

$ maqpna incident export --gateway "$GW" --since 6h --format md --out incident.md
$ maqpna incident export audit.jsonl --since 2026-10-10T02:00:00Z --until 2026-10-10T08:00:00Z -n team-a
$ maqpna incident export --gateway "$GW" --since 24h --detected 2026-10-10T07:45:00Z --all -o json

What happens when you run it#

Prints a table by default; -o json or -o yaml print the data, and --jq EXPR filters the JSON.

Exit codes#

Code	Meaning
`0`	success
`1`	error (the message says what failed, with a hint when there is one)
`2`	usage error: unknown flag, missing argument or bad value; the synopsis is printed
`3`	a check failed, a change is blocked, or a result did not match (tamper, policy mismatch) (not used by this command)

maqpna incident