skills.rest
4lerman
4lermanCOMMUNITY
Explore all skills by this author →
GitHub

incident-response

Automate incident response classification, triage, containment, and forensic evidence collection.

Updated Apr 2, 2026
Search Tags:#classification#triage#containment#forensics#regulatory-compliance#security-incident
One-click install
npx skills add https://github.com/4lerman/text_evaluator --skill incident-response-4lerman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident-response
Source: https://github.com/4lerman/text_evaluator/tree/main/.agents/skills/engineering-skills/incident-response
Command: npx skills add https://github.com/4lerman/text_evaluator --skill incident-response-4lerman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires incident_triage.py, python3, json, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill streamlines the incident response process, providing a comprehensive framework for classifying, triaging, and managing security incidents.

Core Features & Use Cases

  • Incident Triage: Classify events into 14 incident types, score severity, and determine escalation paths.
  • False Positive Filtering: Apply filters to reduce false positives and improve accuracy.
  • Forensic Evidence Collection: Collect and preserve evidence according to DFRWS six-phase framework.
  • Escalation Paths: Define clear escalation paths based on severity and incident type.
  • Regulatory Compliance: Ensure compliance with various regulatory frameworks and deadlines.
  • Workflows: Provide detailed workflows for quick triage, full incident response, and tabletop exercises.
  • Anti-Patterns: Identify and avoid common incident response mistakes.
  • Cross-References: Link to related skills for a holistic security approach.
  • Use Case: When a security incident is detected, use this Skill to classify the incident, determine its severity, and initiate the appropriate response actions.

Quick Start

Run the incident_triage.py script with the event JSON payload to classify and triage the incident.

Frequently Asked Questions about incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate security incident triage and classification from initial detection?▼

You can automate security incident triage by running the incident_triage.py script with an event JSON payload to classify events into 14 incident types, score severity from SEV1 to SEV4, and determine escalation paths.

What is the best way to filter false positives during security incident response?▼

The best way to filter false positives during security incident response is to apply built-in filtering rules within the triage workflow, which reduces false positives and improves classification accuracy before escalating events.

How does forensic evidence collection work for regulatory compliance in incident response?▼

Forensic evidence collection for regulatory compliance works by preserving evidence according to the DFRWS six-phase framework, ensuring incident handling meets various regulatory frameworks and compliance deadlines.

Do I need Python3 to run incident triage workflows and process event JSON payloads?▼

Yes, you need Python3 installed to execute the incident_triage.py script and its associated libraries, which parse event JSON payloads to classify incidents and initiate appropriate response actions.

Can I use this incident response framework for tabletop exercises and quick triage?▼

Yes, you can use this incident response framework for tabletop exercises and quick triage, as it provides detailed workflows specifically designed for both rapid triage scenarios and full incident response simulations.

What are common incident response anti-patterns and mistakes to avoid during containment?▼

Common incident response anti-patterns and mistakes to avoid during containment include misclassifying severity levels and bypassing defined escalation paths, which this Skill identifies to ensure proper SEV1-SEV4 handling.

Related Skills

LoxtepIncLoxtepInc
1

loxtep-queue-tracing

Inspect Loxtep runtime event queues to debug workflow execution and data flow issues.

Official
Intermediate
jaskaranhundaljaskaranhundal
3

forensics

Reconstruct digital forensics timelines and extract Indicators of Compromise.

Community
Advanced
dapperdiversdapperdivers
1

rss-analyzer

Analyze cybersecurity RSS feeds to prioritize threat intelligence entries.

Community
Intermediate
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced