incident-classification

Classify security events into 14 incident types with severity levels.

3|3|Updated Mar 8, 2026

Search Tags:#triage #escalation #severity assessment #incident classification #false positive #security event

Ready to run

npx skills add https://github.com/jaskaranhundal/usap-skills --skill incident-classification-jaskaranhundal

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: incident-classification
Source: https://github.com/jaskaranhundal/usap-skills/tree/main/response/incident-classification
Command: npx skills add https://github.com/jaskaranhundal/usap-skills --skill incident-classification-jaskaranhundal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill automates the initial triage of security events, ensuring they are correctly classified, prioritized, and routed to the appropriate response team, reducing manual effort and speeding up incident response.

Core Features & Use Cases

Automated Classification: Assigns one of 14 incident types to any incoming security event.
Severity Assessment: Determines the initial severity level (critical to info).
False Positive Detection: Identifies and flags potential false positives based on predefined rules.
Escalation Routing: Recommends the correct escalation path (L1-L4).
Use Case: When a new alert fires in the SIEM, this Skill automatically categorizes it as a 'credential_compromise' with 'high' severity and suggests escalation to the L2 SOC team, while also flagging it as a potential false positive if it matches a known automation pattern.

Quick Start

Classify the provided security event details.

Frequently Asked Questions about incident-classification

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate security event triage and incident classification?▼

Automate security event triage by classifying incoming alerts into 14 predefined incident types and assigning severity levels. This reduces manual effort by routing correctly categorized incidents to the appropriate response teams.

What is the best way to assess incident severity and route escalations in a SOC?▼

Assess incident severity using a dedicated severity matrix that ranks events from critical to info, then route escalations by recommending the correct escalation path from L1 to L4 for security operations.

How do I identify false positives during security event triage?▼

Identify false positives during security event triage by matching incoming events against predefined rules and known automation patterns, automatically flagging matches to prevent unnecessary manual reviews.

Can I use this incident classification taxonomy for SIEM alert routing?▼

Yes, you can use the 14 incident type taxonomy for SIEM alert routing. When a new alert fires, it automatically categorizes the event, assigns severity, and suggests the correct L1-L4 escalation path.

What incident types are supported for security event classification?▼

Security event classification supports a taxonomy of 14 predefined incident types, including categories like credential compromise. It uses these types alongside a severity matrix to ensure accurate assessment.

When should I flag a security event as a false positive?▼

Flag a security event as a false positive when it matches known automation patterns or predefined rules. This incident classification approach prevents unnecessary escalations during security event triage.