skills.rest
backbay-labs
backbay-labsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

bb-edr: Triage Skill

Convert ClawdStrike audit logs into incident reports with response plans.

285|33|Updated Jan 31, 2026
Search Tags:#security#report generation#incident response#policy enforcement#audit logs
One-click install
npx skills add https://github.com/backbay-labs/clawdstrike --skill bb-edr-triage-skill
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bb-edr: Triage Skill
Source: https://github.com/backbay-labs/clawdstrike/tree/main/examples/bb-edr/skills/edr-triage
Command: npx skills add https://github.com/backbay-labs/clawdstrike --skill bb-edr-triage-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps streamline the process of converting clawdstrike audit logs into comprehensive incident reports and concise response plans, enabling quick analysis and response to security incidents.

Core Features & Use Cases

  • Audit Log Analysis: Summarize the last 50 audit events from the clawdstrike audit log.
  • Incident Reporting: Generate a report detailing the timeline, impact assessment, and recommended response.
  • Policy Checking: Ensure that any proposed response actions are in line with the active security policy.
  • Output: Produces a Markdown report file named 'incident.md' with the final report.

Quick Start

Run the bb-edr: Triage Skill to generate an incident report from the audit logs.

Frequently Asked Questions about bb-edr: Triage Skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I convert clawdstrike audit logs into incident reports?▼

You can convert clawdstrike audit logs into incident reports by running the Triage Skill, which summarizes the last 50 audit events and outputs a Markdown report detailing the timeline, impact, and recommended response.

What do I need to generate a security incident report from audit logs?▼

Generating a security incident report requires active clawdstrike audit events and active security policy files present in your environment to validate proposed response actions during the conversion process.

How does policy enforcement work when generating an incident response plan?▼

Policy enforcement validates proposed response actions against your active security policy files, ensuring the generated incident report and its minimal response plan align with your defined security protocols.

Can I summarize audit events for incident response using scripts?▼

Yes, the Triage Skill utilizes script execution to analyze audit events, summarizing the last 50 entries from your clawdstrike audit logs into a comprehensive incident report with a response plan.

What is the output format for incident reports generated from audit logs?▼

The output format for incident reports generated from audit logs is a Markdown file named 'incident.md', containing the full timeline, impact assessment, and recommended response plan.

Related Skills

Explore More Software Engineering Skills→
snoodleboot-iosnoodleboot-io
2

Incident Timeline Creation (Minimal)

Generate incident timelines from structured event log data.

Official
Intermediate
lm93129lm93129
2

cybersecurity-review

Automate cybersecurity evaluations and generate structured reports with findings and recommendations.

Community
Advanced
martinholovskymartinholovsky
12

sota-detection-engineering

Construct security detections and SOC workflows from threat intelligence.

Community
Advanced
ivegamsftivegamsft

security-operations

Automate security monitoring, threat detection, and incident response workflows for Kubernetes environments.

Community
Advanced