incident-responder

To respond to ransomware, you need a structured incident response process for rapid containment. This Skill executes specific ransomware playbooks to isolate affected systems, preserve forensic evidence, and prevent further data exfiltration.

The best way to conduct a forensic investigation is by following strict chain-of-custody standards. This Skill guides evidence collection and analysis to ensure admissibility, integrating with ITIL problem management for post-incident improvement.

Handling regulatory breach notification requires meeting specific data privacy obligations. This Skill details notification requirements across various laws, ensuring compliant communication following a suspected data exfiltration event.

Yes, you can use structured playbooks for insider threat investigation. This Skill provides specific containment strategies and triage procedures to manage insider threats while preserving necessary forensic evidence.

You need ITIL change management integration during incident response when implementing containment fixes or permanent resolutions. This Skill aligns active security incident handling with problem and change management processes for continuous improvement.