conducting-cloud-incident-response
OfficialAutomate cloud incident response with identity containment and log analysis.
Authorbalsm-health
Version1.0.0
Installs0
System Documentation
What problem does it solve?
This Skill automates cloud incident response by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition, adapted for ephemeral cloud infrastructure.
Core Features & Use Cases
- Identity Containment: Disable compromised access keys and attach deny-all policies to compromised users.
- Log Analysis: Analyze cloud-native logs for suspicious activity.
- Resource Isolation: Isolate compromised resources and capture evidence.
- Use Case: When a cloud security posture management (CSPM) alert indicates unauthorized resource changes, this Skill can automatically disable compromised access keys, attach deny-all policies, and isolate the affected resources.
Quick Start
Run the agent script with the incident ID and compromised IAM username: python agent.py --incident-id INC-2025-001 --username compromised-user.
Dependency Matrix
Required Modules
awsclipowershellgcloud
Components
scriptsreferences
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: conducting-cloud-incident-response Download link: https://github.com/balsm-health/Balsm-AI/archive/main.zip#conducting-cloud-incident-response Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 620,000+ vetted skills library on demand.