Import UAPF package: incident-triage.uapf

fixtures/signal-email-customer-lv.json

@@ -0,0 +1,16 @@
+{
+  "source": "email",
+  "external_id": "MSG-2026-05-25-001",
+  "raw_payload": {
+    "subject": "Klients SIA Latvija Tev: lūgums palielināt joslas platumu",
+    "from": "ivars.berzins@klients-latvija.lv",
+    "to": "atbalsts@lvrtc.lv",
+    "body": "Labdien, mūsu uzņēmumam nepieciešams palielināt internet pieslēguma joslas platumu no 100 Mbps uz 500 Mbps. Lūdzu, informējiet par procedūru un izmaksām. Ar cieņu, Ivars Bērziņš"
+  },
+  "expected_after_triage": {
+    "taxonomy_code": "service.customer_request",
+    "priority": "P3",
+    "ownership": "lvrtc",
+    "group_slug": "helpdesk-l1"
+  }
+}

fixtures/signal-zabbix-ddos.json

@@ -0,0 +1,17 @@
+{
+  "source": "zabbix",
+  "external_id": "ZBX-EVT-9374",
+  "raw_payload": {
+    "title": "DDoS attack pattern detected on edge",
+    "host": "rtr-r3.lvrtc.lv",
+    "severity": "critical",
+    "body": "Volumetric UDP flood, 4.2 Gbps inbound to 192.0.2.0/24. Source: 12 ASNs, predominantly AS197207. Auto-mitigation engaged.",
+    "tags": ["security", "ddos"]
+  },
+  "expected_after_triage": {
+    "taxonomy_code": "security.incident",
+    "priority": "P1",
+    "ownership": "lvrtc",
+    "group_slug": "soc-l2"
+  }
+}

fixtures/signal-zabbix-link-down.json

@@ -0,0 +1,18 @@
+{
+  "source": "zabbix",
+  "external_id": "ZBX-EVT-9342",
+  "raw_payload": {
+    "title": "Link down on edge router rtr-r1",
+    "host": "rtr-r1.lvrtc.lv",
+    "severity": "high",
+    "body": "Interface ge-0/0/3 went DOWN at 09:14:02 UTC. BGP session to upstream provider AS6939 also flapping.",
+    "event_id": "9342",
+    "tags": ["network", "edge"]
+  },
+  "expected_after_triage": {
+    "taxonomy_code": "network.routing",
+    "priority": "P1",
+    "ownership": "lvrtc",
+    "group_slug": "noc-l2"
+  }
+}