skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

defensive-incident-response

Guides security teams through structured incident response using the PICERL lifecycle and KQL queries.

1|Updated Apr 27, 2026
Search Tags:#incident#response#kql#picerl#mitre#mde#hunt-queries
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-incident-response
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-incident-response
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-incident-response
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-incident-response

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Incident response lifecycles can be chaotic; this playbook provides a structured, repeatable approach to identify, contain, and eradicate threats using the PICERL lifecycle, evidence collection order, and KQL queries for rapid investigation.

Core Features & Use Cases

  • PICERL phases with concrete actions and decision points
  • Containment guidance, evidence ordering, and MITRE ATT&CK mapping
  • Per-phase KQL hunt queries and remediation steps
  • Use case: contain a compromised host, scope lateral movement, and rotate credentials

Quick Start

Initiate incident response by identifying scope, isolating affected hosts, and executing the PICERL lifecycle with recommended actions.

Frequently Asked Questions about defensive-incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I structure incident response using the PICERL lifecycle?▼

PICERL incident response structures breach containment through sequential phases with concrete actions, decision points, and per-phase KQL hunt queries to rapidly identify, contain, and eradicate threats across on-prem and cloud environments.

What is the best way to contain lateral movement across compromised hosts?▼

Containing lateral movement requires applying a structured containment matrix to isolate affected single-host or multi-host endpoints, scope the breach using KQL hunt queries, and execute remediation steps to eradicate the threat.

How do I map detected threats to MITRE ATT&CK techniques during an incident?▼

Mapping detected threats to MITRE ATT&CK techniques is integrated into the incident response playbook, correlating scoped lateral movement and endpoint evidence with per-phase KQL hunt queries to guide targeted eradication.

Can I use KQL hunt queries for incident response in both on-prem and cloud environments?▼

KQL hunt queries apply to both on-prem and cloud environments, scoping multi-host lateral movement scenarios across endpoints and cloud services to investigate breaches and execute rapid containment.

What is the correct evidence collection order during a security breach?▼

The correct evidence collection order prioritizes volatile endpoint and cloud service data before isolation, ensuring forensic integrity is maintained while executing the PICERL lifecycle for rapid incident containment.

Does this incident response playbook support credential rotation after host isolation?▼

Yes, credential rotation is a core remediation step within the playbook, applied after isolating compromised hosts and scoping lateral movement to eradicate threats and secure on-prem and cloud environments.

Related Skills

Explore More Data & Analytics Skills→
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
jassicsjassics
6

incident-response

Orchestrate security incident response using NIST SP 800-61 and SANS PICERL.

Community
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced