incident-responder

Incident response for suspected malicious skills involves immediate threat containment, impact investigation, compromised credential rotation, and secure state restoration. The protocol provides step-by-step checklists for each recovery phase.

Incident triage classifies security events from SEV-1 to SEV-4 based on severity. This classification determines the phased response protocol, ensuring appropriate containment and recovery actions are taken.

Evidence preservation during incident response involves safely collecting logs, screenshots, and skill configurations. This ensures structured incident documentation and accurate reporting for post-incident analysis and recovery.

Containing active data exfiltration requires immediate execution of quick response commands to isolate the threat. The incident response protocol provides specific checklists to stop ongoing data loss and secure the environment.

Yes, the incident response protocol handles policy violations alongside active data exfiltration scenarios. It provides structured documentation, investigation steps, and recovery checklists tailored to each specific security incident type.