skills.rest
imMamdouhaboammar
imMamdouhaboammarCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

agency-incident-responder

Leads breach investigations, threat containment, forensic triage, and post-mortem reporting for security incidents.

Updated Jul 27, 2026
Search Tags:#post-mortem#incident response#siem#malware analysis#digital forensics#breach investigation#threat containment
One-click install
npx skills add https://github.com/imMamdouhaboammar/Mimera --skill agency-incident-responder-immamdouhaboammar
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agency-incident-responder
Source: https://github.com/imMamdouhaboammar/Mimera/tree/main/.agents/skills/security-incident-responder
Command: npx skills add https://github.com/imMamdouhaboammar/Mimera --skill agency-incident-responder-immamdouhaboammar

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? When a security breach occurs, teams often lack a structured response process, leading to destroyed evidence, missed persistence mechanisms, and incomplete remediation. This Skill provides a senior incident responder persona that guides triage, containment, forensics, and post-incident review using established frameworks like NIST SP 800-61. ## Core Features & Use Cases - Incident Triage & Severity Classification: Classify incidents from SEV1 (active exfiltration) to SEV4 (policy violation) with defined response timelines and escalation owners. - Forensic Triage Scripts: Ready-to-run PowerShell and Bash collection scripts that capture volatile data (processes, network connections, memory indicators), persistence mechanisms, event logs, and file system artifacts on Windows and Linux systems. - Containment & Eradication Guidance: Step-by-step playbooks for isolating compromised systems, removing attacker persistence, and verifying containment effectiveness. - Post-Mortem & Remediation Tracking: Structured blameless retrospectives that produce prioritized, tracked recommendations. - Use Case: Your EDR flags suspicious lateral movement from a web server to a database. Use this Skill to classify the incident as SEV1, run the triage collection script on affected hosts, coordinate containment, and produce a timeline-backed post-mortem. ## Quick Start Ask the incident responder to triage a suspected compromise on a Windows server and walk you through evidence collection and containment steps.

Frequently Asked Questions about agency-incident-responder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I respond to a security breach in the first 30 minutes?▼

Start with triage: confirm the alert is a true positive, assess scope and whether the attacker is still active, then classify severity using the SEV1-SEV4 matrix. Assemble the response team, open an incident ticket, and begin logging every action with UTC timestamps.

How to collect forensic evidence from a compromised Windows machine?▼

Run the provided PowerShell triage script as Administrator to capture volatile data first: running processes, network connections, DNS cache, and logon sessions. It then enumerates persistence mechanisms like scheduled tasks, Run keys, and WMI subscriptions, plus critical event logs.

What is the difference between SEV1 and SEV2 incident severity?▼

SEV1 covers active data exfiltration, in-progress ransomware, or confirmed PII/PHI/PCI breaches requiring immediate 24/7 response. SEV2 covers confirmed single-system compromise or contained malware, requiring same-business-day response with containment within 4 hours.

Does this incident response approach work for cloud environments like AWS?▼

Yes, the Skill covers cloud incident response including AWS CloudTrail log analysis, GuardDuty triage, IAM forensics, Azure Unified Audit Log review, and GCP Cloud Audit Logs. It also addresses container forensics such as pod inspection and image layer analysis.

Why is memory capture prioritized before other forensic steps?▼

Memory is volatile evidence that disappears on reboot, taking running processes, injected code, network connections, and encryption keys with it. The workflow requires capturing memory with tools like WinPMEM or LiME before any containment action that could power off the system.

When should you not wipe and rebuild a compromised system immediately?▼

Never wipe before forensic imaging, since doing so destroys evidence needed to determine root cause and full scope. Isolate the system instead, acquire forensic images with documented chain of custody, then rebuild from known-good images only after investigation completes.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
954

hunting-for-spearphishing-indicators

Detect spearphishing campaigns by hunting indicators across email logs, endpoint telemetry, and network data.

Community
Intermediate
Fr-e-dFr-e-d
157

security-audit

Scan code and configurations for security vulnerabilities and governance violations.

Community
Advanced
xalgordxalgord
954

analyzing-threat-actor-ttps-with-mitre-attack

Maps threat actor behavior to MITRE ATT&CK techniques and generates Navigator layers for detection gap analysis.

Community
Intermediate
drupadsachaniadrupadsachania

threat-hunting

Generate hypotheses and artifacts for MITRE ATT&CK-aligned threat hunting.

Community
Advanced