万が一感染した最初の15分、なぜ「パソコンの電源を切らずにLANケーブルを抜く」のが鉄則なのか？ — 72時間トリアージ実践ガイド

#![forbid(unsafe_code)]

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct IncidentTelemetry {
    pub network_isolated_keep_power: bool,
    pub volatile_ram_captured: bool,
    pub pii_records_affected: u32,
    pub ransomware_encryption_detected: bool,
    pub medical_or_critical_infra: bool,
    pub hours_since_discovery: u16,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum TriageDirective {
    ImmediateIsolateLanKeepPowerOn,
    AcquireVolatileMemoryAndSocketTable,
    FileStatutoryPpcAndPoliceReportUrgent,
    ExecuteCleanRoomZfsRestoreAndRotateKeys,
}

/// Determines the highest-priority incident response directive during the first 72 hours.
pub fn compute_next_triage_directive(t: &IncidentTelemetry) -> TriageDirective {
    // Rule 1: Never allow lateral movement; isolate L2 immediately while preserving RAM
    if !t.network_isolated_keep_power {
        return TriageDirective::ImmediateIsolateLanKeepPowerOn;
    }
    // Rule 2: Capture RFC 3227 volatile evidence before any reboot or disk touch
    if !t.volatile_ram_captured {
        return TriageDirective::AcquireVolatileMemoryAndSocketTable;
    }
    // Rule 3: Statutory notification under APPI Article 26 (Ransomware or PII breach)
    let requires_ppc_report = t.ransomware_encryption_detected
        || t.pii_records_affected > 0
        || t.medical_or_critical_infra;
    if requires_ppc_report && t.hours_since_discovery <= 120 {
        return TriageDirective::FileStatutoryPpcAndPoliceReportUrgent;
    }
    TriageDirective::ExecuteCleanRoomZfsRestoreAndRotateKeys
}