Guide security incident response, investigation, and remediation processes. Use when you need to handle security breaches, classify incidents, develop response playbooks, gather forensic evidence, or coordinate remediation efforts. Trigger with phrases like "security incident response", "ransomware attack response", "data breach investigation", "incident playbook", or "security forensics".
Limited to specific tools
Additional assets for this skill
This skill is limited to using the following tools:
assets/README.mdreferences/README.mdscripts/README.mdscripts/evidence_collector.shscripts/incident_classifier.pyscripts/timeline_builder.pyname: responding-to-security-incidents description: | Guide security incident response, investigation, and remediation processes. Use when you need to handle security breaches, classify incidents, develop response playbooks, gather forensic evidence, or coordinate remediation efforts. Trigger with phrases like "security incident response", "ransomware attack response", "data breach investigation", "incident playbook", or "security forensics". allowed-tools:
Before using this skill, ensure:
Classify the security incident:
Prevent further damage:
Gather forensic data systematically:
System Evidence:
Log Evidence:
Network Evidence:
Reconstruct the attack timeline:
Remove threat from environment:
Restore normal operations:
Create comprehensive incident report:
The skill produces:
Primary Output: Incident response playbook saved to {baseDir}/incidents/incident-YYYYMMDD-HHMM.md
Playbook Structure:
# Security Incident Response - [Incident Type]
Date: YYYY-MM-DD HH:MM
Severity: CRITICAL
Status: Contained
## Executive Summary
- Incident type: Ransomware attack
- Detection time: 2024-01-15 08:30 UTC
- Affected systems: 15 servers, 200 workstations
- Business impact: Production halted
- Current status: Contained, recovery in progress
## Timeline of Events
08:30 - Initial detection via EDR alert
08:35 - IT team confirms ransomware encryption
08:40 - Network isolation initiated
09:00 - Incident response team activated
[Detailed timeline continues]
## Containment Actions Taken
✅ Isolated affected network segments
✅ Disabled compromised accounts
✅ Blocked C2 server IPs
✅ Preserved forensic evidence
## Evidence Collected
- Memory dumps: 15 systems
- Log files: {baseDir}/incidents/evidence/logs/
- Network captures: {baseDir}/incidents/evidence/pcaps/
- Malware samples: Quarantined
## IOCs (Indicators of Compromise)
- IP addresses: 203.0.113.45, 198.51.100.78
- File hashes: SHA256 values listed
- Domain names: malicious-c2.example
- Registry keys: HKLM\Software\[malware]
## Remediation Plan
Priority 1 (Immediate):
- Remove ransomware from all systems
- Reset all domain credentials
- Patch vulnerable RDP service
Priority 2 (24 hours):
- Deploy endpoint protection updates
- Implement network segmentation
- Enable MFA for all accounts
Priority 3 (1 week):
- Security awareness training
- Update incident response procedures
- Conduct tabletop exercise
## Recovery Status
- Clean backups identified: 2024-01-14 backup
- Systems rebuilt: 5/15 servers complete
- Services restored: Email, file servers online
- Estimated full recovery: 48 hours
## Communication Log
- 08:45 - Executive team notified
- 09:30 - Legal counsel engaged
- 10:00 - Cyber insurance contacted
- 12:00 - Customer notification prepared
Secondary Outputs:
Common Issues and Resolutions:
Incomplete Log Data
Evidence Contamination
Ongoing Active Threat
Insufficient Access for Forensics
Backup Corruption
Incident Response Frameworks:
Forensic Tools:
Threat Intelligence:
Communication Templates:
Playbook Templates:
Legal and Compliance: