agency-incident-responder

Digital forensics and incident response requires systematic threat triage, evidence preservation, and post-mortem analysis. This skill facilitates rapid assessment, volatile data collection, and containment planning to minimize operational downtime during active cyberattacks.

Triage and classification of ransomware requires a standardized framework to assess incident severity and prioritize response efforts. This skill helps rapidly evaluate the threat, capture memory and network state, and generate a containment plan to stop lateral movement.

Yes, incident response evidence collection supports both Windows and Linux systems. The skill executes automated collection of volatile data, persistence mechanisms, and event logs across diverse infrastructure environments to preserve critical forensic evidence.

Maintaining chain of custody and incident documentation according to NIST SP 800-61 requires systematic evidence preservation and post-mortem analysis. This skill satisfies technical requirements for standardized incident documentation and response adherence.

Yes, threat hunting and detecting lateral movement during active attacks are supported. The skill provides comprehensive capabilities for investigating security breaches, capturing network state, and generating containment plans to prevent further lateral movement.

Forensic triage is the rapid collection of volatile data, persistence mechanisms, and event logs to preserve evidence. You need it immediately when a breach is detected to prevent data loss and ensure critical system state is captured before it is lost.