Pokee Playbook
Build an incident timeline and a regulatory notification matrix from your incident documents.
In the first hours of an incident, the question is not what the law says in the abstract. It is: what do we know, what do we owe, and what are we still missing.
Every event from the phishing email through vendor notification is extracted and cited. The incident timeline is the centerpiece, not an afterthought.
Every notification obligation is mapped with its trigger and deadline. Where a deadline is in a source, it is cited. Where the skill supplies a general reference, it is marked to verify.
Every vendor statement is set against the contract clause it implicates, both cited. The leverage points are on the table, not buried in email.
Four stages, one run. While the clock runs.
What you have, inventoried
The outcome: A clean scope of the incident record, in the first hour.
Every event cited
The outcome: An incident fact base where every row can be traced to a document.
What you owe, and when
The outcome: An obligation map that is the working document for the notification decision.
The first internal brief
The outcome: A draft for attorney review that tells you what is known, what is owed, and what is missing.
Northgate Data Breach Incident INC-2026-001 (fictional). A vendor reports that a phishing attack gave an unauthorized actor access to Northgate customer data. Six documents in; the output below is real.
INC-2026-001 · Northgate / Clearpath MSA §3
| Side | Statement | Citation |
|---|---|---|
| Vendor | Clearpath acknowledges in writing that the interval between detection and notification was approximately four days | Email_Cho_to_Reyes_2026-01-15.txt |
| Contract | MSA Section 3 requires notification without undue delay and within 24 hours of detection | MSA_Clearpath_2024-06-01.txt §3 |
The skill does not weigh whether that is a breach. It puts the vendor admission and the contract clause side by side, both cited, with the issue status marked open.
The skill operates on your own Pokee deployment, including fully offline or air gapped environments. Incident data does not leave your control.
Where a deadline is in a source, it is cited. Where the skill supplies a general regulatory reference, it is marked to verify and labeled as a general reference.
Vendor statements are recorded as statements, with citation, and set against the record. They are not treated as verified facts.
Run the skill on one real incident of your choosing, with your own documents, on your own infrastructure.
Book a walkthrough