skills.rest
UnitOneAI
UnitOneAIOFFICIAL
Explore all skills by this author →
WebsiteGitHub

containment

Generate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.

44|128|Updated Mar 6, 2026
Search Tags:#network isolation#MITRE ATT&CK#SOC#incident containment#NIST SP 800-61#credential revocation#DNS sinkholing
One-click install
npx skills add https://github.com/UnitOneAI/SecuritySkills --skill containment-unitoneai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: containment
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/incident-response/containment
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill containment-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It provides structured, framework-referenced guidance for isolating an ongoing incident and limiting further damage while balancing operational disruption.

Core Features & Use Cases

  • NIST SP 800-61 Rev 2 containment decisioning: Chooses containment actions based on damage potential, evidence preservation, service availability, resources, and duration.
  • MITRE ATT&CK technique mapping: Produces countermeasures tied to the attacker’s observed TTPs (initial access, lateral movement, command and control, persistence, and destructive malware).
  • Actionable, auditable output: Produces a containment plan with short-term and long-term actions, validation checklist, business impact assessment, and rollback criteria suitable for SOC and security engineering teams.
  • Safety guardrails: Emphasizes planning only (human execution for containment actions) and avoids leaking sensitive attacker details.

Quick Start

Ask an AI coding agent to create a containment plan for a confirmed incident that requires network isolation and credential revocation, and include the relevant incident ID and targets.

Frequently Asked Questions about containment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I build a NIST SP 800-61 incident containment plan for network isolation?▼

To build a NIST SP 800-61 incident containment plan, generate strategies that isolate compromised systems by evaluating damage potential, evidence preservation, and service availability. This produces structured short-term and long-term network isolation actions with validation checklists.

How do I map MITRE ATT&CK countermeasures for active incident response?▼

Mapping MITRE ATT&CK countermeasures for incident response involves generating targeted actions tied to observed attacker TTPs. This applies to initial access, lateral movement, and command and control, producing structured countermeasures to prevent further attacker activity.

When do I need to use DNS sinkholing and credential revocation during incident containment?▼

You need DNS sinkholing and credential revocation during incident containment when an active incident is confirmed and isolation decisions are required. These actions help block command and control traffic and secure compromised accounts while balancing operational disruption.

Can I use automated containment planning to balance service availability and evidence preservation?▼

Automated containment planning balances service availability and evidence preservation by applying NIST SP 800-61 Rev 2 decision criteria. It assesses damage potential, resources, and duration to produce auditable containment actions that limit operational disruption.

What are the limitations of using an AI containment plan generator for SOC workflows?▼

The limitation of an AI containment plan generator for SOC workflows is that it provides planning only. It emphasizes human execution for containment actions and includes safety guardrails to avoid leaking sensitive attacker details, meaning it cannot execute isolation actions directly.

Related Skills

Explore More Software Engineering Skills→
do360nowdo360now

containment

Generate containment plans for cyber security incidents across networks and systems.

Community
Advanced
petrkindlmannpetrkindlmann
64

release-readiness

Generate evidence-based go/no-go decisions for software releases.

Community
Advanced
jassicsjassics
6

attack-lookup

Map observed behaviors to MITRE ATT&CK technique IDs and references.

Community
Intermediate
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced