skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

containment

Generate containment playbooks to isolate threats across network, endpoint, identity, cloud, and application layers.

5|Updated Jan 12, 2026
Search Tags:#automation#cybersecurity#playbooks#endpoint#network#containment#incident-response
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill containment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: containment
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/cybersecurity/containment
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill containment

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides structured containment playbooks to isolate threats during active security incidents, enabling responders to rapidly contain threats across multiple layers.

Core Features & Use Cases

  • Network Containment: Host isolation, firewall controls, DNS sinkholing, and segmentation.
  • Endpoint Containment: EDR-based quarantine, process and service actions, memory preservation.
  • Identity Containment: Account disablement, session termination, password reset workflows.
  • Cloud Containment: IAM revocation, resource isolation, API key rotation, and access governance.
  • Application Containment: WAF rules, rate limiting, and service lockdown.
  • Playbook Management: Track actions, document decisions, and generate reports for incident review.

Quick Start

Create and run a containment playbook by using the containment utilities to instantiate actions from NetworkContainment, EndpointContainment, IdentityContainment, CloudContainment, and ApplicationContainment, then compile a final report.

Frequently Asked Questions about containment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I isolate threats during an active cybersecurity incident?▼

Containment playbooks orchestrate threat isolation by applying programmatic action types across network, endpoint, identity, cloud, and application layers to restrict attacker movement during active incidents.

What actions are included in network and endpoint containment playbooks?▼

Network containment actions include host isolation, firewall controls, DNS sinkholing, and segmentation, while endpoint containment covers EDR-based quarantine, process termination, service actions, and memory preservation.

How do I automate identity and cloud containment for compromised accounts?▼

Identity and cloud containment automates account disablement, session termination, password resets, IAM revocation, resource isolation, and API key rotation to secure compromised access paths.

Does this incident response Skill support rollback hooks and API integrations?▼

Yes, the containment playbooks define metadata, rollback hooks, and API payload generation to support direct platform integrations and safe action reversal during SOC operations.

Can I generate executive reports and track decisions from containment actions?▼

Yes, playbook management tracks applied actions, documents responder decisions, and compiles a final report to support incident review and executive reporting.

What is the best way to lock down applications during a security incident?▼

Application containment applies WAF rules, rate limiting, and service lockdown actions to isolate application layer threats and prevent further unauthorized access.

Related Skills

Explore More Software Engineering Skills→
polaris-dxzpolaris-dxz
1

log-analyzer

Analyze and correlate multi-source logs to detect anomalies and trends.

Community
Intermediate
mitchuskimitchuski

agentprivacy-forensic-defense

Contain privacy breaches, preserve evidence, and assess key material damage.

Community
Advanced
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
williamzujkowskiwilliamzujkowski
17

security-operations

Orchestrate SOC incident response and threat hunting across on-premises and cloud environments.

Community
Advanced