Incident register: severity, categories and dates

The detection time is what a breach-notification assessment is measured from, so Graften refuses an incident it can't record accurately rather than guessing. See Breach notification: regulator time limits for each regulator's limit.

Values an incident accepts

• Severity: critical, high, medium or low (medium if left blank).
• Category: ransomware, phishing, data_breach, unauthorised_access, malware, ddos, insider or other.
• Status: open, investigating, contained, resolved or closed.

Anything else is refused with a 400 (INVALID_SEVERITY, INVALID_CATEGORY) instead of being stored as typed.

Detection time

detected_at must be a full timestamp with a time zone, for example 2026-10-14T09:30:00+10:00, and can't be in the future. Left blank, it is the time the incident is created. A value Graften can't read is refused (INVALID_DETECTED_AT) — it is never quietly replaced with "now".

Reopening

Moving a resolved, closed or contained incident back to open or investigating clears its resolved and contained dates, so a live incident never reads as resolved.