# Response playbook for AN:DET:Detection Signature:02. See PB-00 header for provenance.
# This playbook is entirely space-domain except its reporting leg, which is the
# shape a link-layer incident takes: nothing in a log sees it.
playbook: PB-02
name: Sustained RF noise-floor anomaly
covers: AN:DET:Detection Signature:02
tdm: AST:SI:Signal:00
status: active
trigger: >
  AN:DET:Detection Signature:02 fires on a noise-floor anomaly at
  AST:SI:Signal:00 beyond the environmental threshold, at medium confidence or
  higher. The threshold is medium and not any, because atmospheric loss and
  local interference produce the same reading and the assess stage separates
  them.
roles:
    accountable: Mission Lead
    cyber: Security Operations
    space: Satellite Operations
actions:
    - id: ACT:00
      stage: assess
      domain: space
      action: Confirm through a secondary ground station that the elevated noise on the waveform is platform-targeted rather than local.
      element: AST:SI:Signal:00
      reversibility: reversible
      level: solo
      raci: { r: Satellite Operations, a: Mission Lead, c: [], i: [Security Operations] }
    - id: ACT:01
      stage: contain
      domain: space
      action: Switch the link to the backup band or to spread-spectrum mode.
      element: AST:SI:Signal:00
      reversibility: disruptive
      level: collaborative
      raci: { r: Satellite Operations, a: Mission Lead, c: [Security Operations], i: [] }
    - id: ACT:02
      stage: recover
      domain: space
      action: File the geolocation request with the interference-mitigation team.
      element: AST:SI:Signal:00
      reversibility: reversible
      level: solo
      raci: { r: Satellite Operations, a: Mission Lead, c: [], i: [Security Operations] }
    - id: ACT:03
      stage: recover
      domain: space
      action: Adjust pass scheduling around the affected windows while the interference persists, and confirm link margin returns to baseline.
      element: SVC:HY:Hybrid:02
      reversibility: disruptive
      level: collaborative
      raci: { r: Satellite Operations, a: Mission Lead, c: [Security Operations], i: [] }
    - id: ACT:04
      stage: report
      domain: space
      action: File the ITU interference report through the regulatory liaison.
      element: AST:SI:Signal:00
      reversibility: irreversible
      level: escalated
      raci: { r: Satellite Operations, a: Mission Lead, c: [Security Operations], i: [] }
    - id: ACT:05
      stage: report
      domain: cyber
      action: Notify the duty officer and the CISO and start the NIS2 24-hour early warning, which runs on a sustained denial of the command link even when no data is lost, with the 72-hour notification and one-month final report behind it.
      element: AST:SI:Signal:00
      why: Reporting is an information act carried out by Security Operations; the element names what the report concerns, not where the action lands.
      reversibility: reversible
      level: solo
      raci: { r: Security Operations, a: Mission Lead, c: [], i: [Satellite Operations] }