incident-response

Automate evidence collection during a security incident by activating the Skill to run shell scripts that gather critical system logs, running processes, and network connections for forensic analysis.

Standard incident response phases follow a structured six-phase process from preparation through lessons learned, guiding teams to detect, contain, eradicate, and recover from security breaches.

Handle a compromised server for rapid investigation by triggering an incident response playbook that immediately collects relevant logs and network data to aid in containment.

Yes, you can use this framework to classify the severity of a security breach, as it provides defined severity classifications to help incident commanders prioritize response efforts.

Incident response requires no specific security operations tools to function, as it operates independently without dependencies to automate forensic evidence gathering directly from the current system.