sica-fondt/knowledge/cyber-skills/skills/testing-ransomware-recovery-procedures/references/api-reference.md

API Reference: Testing Ransomware Recovery Procedures

CLI Usage

# Generate hash manifest for a directory (pre-backup baseline)
python agent.py --hash-dir /data/critical-app -o manifest_baseline.json

# Compare original manifest against restored data
python agent.py --compare manifest_baseline.json manifest_restored.json

# Check if a service is running after restore
python agent.py --check-service postgresql

# Check database connectivity after restore
python agent.py --check-db postgresql:localhost:5432

# Run full recovery drill from config
python agent.py --config drill_config.json -o recovery_report.json

Drill Configuration Format

{
  "systems": [
    {
      "name": "core-database",
      "tier": 1,
      "rto_target_seconds": 3600,
      "rpo_target_seconds": 900,
      "backup_timestamp_epoch": 1711000000,
      "restore_directory": "/restored/core-db",
      "manifest_file": "/manifests/core-db-baseline.json",
      "services": ["postgresql"],
      "database": {
        "type": "postgresql",
        "host": "localhost",
        "port": 5432
      }
    },
    {
      "name": "web-application",
      "tier": 2,
      "rto_target_seconds": 14400,
      "rpo_target_seconds": 3600,
      "restore_directory": "/restored/webapp",
      "services": ["nginx", "gunicorn"]
    }
  ]
}

Recovery Phases Tracked

Phase	Timestamp Key	Description
Incident Declaration	incident_declared	Simulated ransomware detection time
Backup Identification	backup_identified	Clean restore point located
Restore Initiated	restore_initiated	Backup restore process started
Restore Completed	restore_completed	Data fully written to target
Service Restored	service_restored	Application validated and operational

RTO/RPO Calculation

Actual RTO = service_restored - incident_declared
Actual RPO = incident_declared - backup_timestamp

RTO Met = Actual RTO <= RTO Target
RPO Met = Actual RPO <= RPO Target

Tier Definitions

Tier	RTO Range	RPO Range	System Classification
1	< 1 hour	< 15 min	Mission-critical (AD, core DB)
2	< 4 hours	< 1 hour	Business-critical (ERP, email)
3	< 24 hours	< 4 hours	Business-operational (file shares)
4	< 72 hours	< 24 hours	Non-critical (dev/test, analytics)

Hash Manifest Format

{
  "config/app.yaml": "a3f2b8c9d1e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0",
  "data/users.db": "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
  "bin/server": "PERMISSION_DENIED"
}

Validation Checks

Check	Description	Pass Criteria
file_count	Files present in restored directory	count > 0
integrity_check	Hash comparison vs baseline manifest	No missing or modified files
service_*	System service running post-restore	Service status is RUNNING/active
database_connectivity	Database port reachable	TCP connection succeeds

Report Output Schema

{
  "report_date": "2026-03-19T12:00:00+00:00",
  "drill_type": "ransomware_recovery_validation",
  "systems_tested": 2,
  "systems_meeting_rto": 2,
  "systems_meeting_rpo": 1,
  "overall_pass": false,
  "results": [
    {
      "system_name": "core-database",
      "tier": 1,
      "rto_target_seconds": 3600,
      "actual_rto_seconds": 2400.5,
      "rto_met": true,
      "rpo_met": true,
      "validations": {},
      "errors": []
    }
  ]
}

References

• NIST SP 800-184: Guide for Cybersecurity Event Recovery
• NIST SP 800-34 Rev 1: Contingency Planning Guide
• CISA Ransomware Guide: https://www.cisa.gov/stopransomware
• Veeam Recovery Best Practices: https://www.veeam.com/blog/recovery-time-recovery-point-objectives.html