# Response playbook for AN:DET:Detection Signature:01. See PB-00 header for provenance.
playbook: PB-01
name: Out-of-pattern command-authority usage
covers: AN:DET:Detection Signature:01
tdm: AST:SW:Software:04
status: active
trigger: >
  AN:DET:Detection Signature:01 fires on out-of-pattern command-authority usage
  at AST:SW:Software:04, at medium confidence or higher. The threshold is medium
  and not any, because filed travel and roster changes produce the same pattern
  and the assess stage separates them.
roles:
    accountable: Mission Lead
    cyber: Security Operations
    space: Satellite Operations
actions:
    - id: ACT:00
      stage: assess
      domain: cyber
      action: Check the filed travel, the shift roster and the change record for this operator, the benign causes the rule names.
      element: AST:SW:Software:04
      reversibility: reversible
      level: solo
      raci: { r: Security Operations, a: Mission Lead, c: [], i: [Satellite Operations] }
    - id: ACT:01
      stage: contain
      domain: cyber
      action: Suspend the operator credential on the ground command-acceptance service.
      element: SVC:CP:Control Plane:09
      reversibility: reversible
      level: solo
      raci: { r: Security Operations, a: Mission Lead, c: [], i: [Satellite Operations] }
    - id: ACT:02
      stage: contain
      domain: space
      action: Fail commanding over to the second ground site.
      element: SVC:HY:Hybrid:03
      why: Changes which site holds live commanding authority, a mission operational state change taken on a ground element.
      reversibility: disruptive
      level: collaborative
      raci: { r: Satellite Operations, a: Mission Lead, c: [Security Operations], i: [] }
    - id: ACT:03
      stage: recover
      domain: cyber
      action: Rotate the ground command-acceptance service credentials.
      element: SVC:CP:Control Plane:09
      reversibility: reversible
      level: solo
      raci: { r: Security Operations, a: Mission Lead, c: [], i: [Satellite Operations] }
    - id: ACT:04
      stage: recover
      domain: space
      action: Replay the command log against the flight plan and confirm the vehicle state matches the last authorized command.
      element: SVC:CP:Control Plane:13
      why: Confirms vehicle state against the flight plan, a mission operational judgment taken on a ground element.
      reversibility: reversible
      level: solo
      raci: { r: Satellite Operations, a: Mission Lead, c: [], i: [Security Operations] }
    - id: ACT:05
      stage: report
      domain: cyber
      action: Notify the duty officer and the CISO, and start the NIS2 clocks, 24-hour early warning, 72-hour notification, one-month final report.
      element: AST:SW:Software:04
      reversibility: reversible
      level: solo
      raci: { r: Security Operations, a: Mission Lead, c: [], i: [Satellite Operations] }
    - id: ACT:06
      stage: report
      domain: cyber
      action: File the redacted Space ISAC Exchange entry.
      element: AST:SW:Software:04
      reversibility: irreversible
      level: escalated
      raci: { r: Security Operations, a: Mission Lead, c: [Satellite Operations], i: [] }