skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

conducting-post-incident-lessons-learned

Facilitate blameless post-incident reviews to produce root cause analyses, metrics, and action items.

954|172|Updated Mar 13, 2026
Search Tags:#post-mortem#cybersecurity#incident response#lessons learned#Root Cause Analysis#sigma rules#MTTD
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill conducting-post-incident-lessons-learned
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-post-incident-lessons-learned
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/conducting-post-incident-lessons-learned
Command: npx skills add https://github.com/xalgord/xalgorix --skill conducting-post-incident-lessons-learned

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

After a security incident is resolved, teams often skip structured reflection, losing the chance to fix root causes and improve detection and response. This Skill guides a complete post-incident lessons-learned process so findings turn into tracked improvements instead of forgotten notes.

Core Features & Use Cases

  • Structured Blameless Post-Mortems: A 90-minute agenda covering timeline walkthrough, what worked, gaps, root cause analysis, and action items.
  • Root Cause Analysis & Metrics: Apply the 5 Whys technique and calculate dwell time, MTTD, MTTC, and MTTR from incident timestamps.
  • Actionable Outputs: Create tracked Jira action items, update IR playbooks, and write new Sigma detection rules based on lessons learned.
  • Use Case: After a ransomware incident, walk the kill chain, identify that weak service account passwords enabled Kerberoasting, file a PAM implementation task, and ship a Sigma rule detecting ticket requests with RC4 encryption.

Quick Start

Conduct a post-incident lessons learned review for incident IR-2024-042, including root cause analysis, response metrics, and action items.

Frequently Asked Questions about conducting-post-incident-lessons-learned

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I conduct a post-incident lessons learned review?▼

Gather the incident timeline and responder actions, then run a blameless 90-minute meeting covering the timeline, what worked, gaps, root cause analysis, and action items. Finish by documenting metrics, filing tracked tasks, and updating playbooks and detection rules.

How to perform root cause analysis after a security incident?▼

Use the 5 Whys technique: iteratively ask why each failure occurred until you reach a systemic cause, such as a missing privileged access management control. Focus on systems and processes rather than blaming individuals.

What metrics should I calculate in an incident post-mortem?▼

Calculate dwell time (compromise to detection), MTTD (detection to triage), MTTC (detection to containment), and MTTR (eradication to recovery). These are derived from timestamped incident events using a simple datetime script.

What tools support post-incident review documentation?▼

TheHive or ServiceNow provide incident timelines, Jira or Azure DevOps track action items, Confluence stores lessons learned, and Splunk or Elastic supply metrics. Sigma is used to codify new detection rules from findings.

When should a lessons learned session be held?▼

Hold one after any incident is fully contained, eradicated, and recovered, after tabletop exercises or simulations, after significant near-misses, or quarterly to review accumulated incident trends. The incident must be fully resolved first.

Related Skills

Explore More Software Engineering Skills→
latestaiagentslatestaiagents
5

logging-monitoring

Implement structured security logging and alerting for OWASP A10 compliance.

Official
Advanced
stakworkstakwork
109

gap-surfacer

Track regulatory and policy compliance gaps through assignment, remediation, monitoring, closure, or risk acceptance.

Official
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced