skills.rest
defconxt
defconxtCOMMUNITY
Explore all skills by this author →
GitHub

Incident Response

Guide cybersecurity incident response with commands for data collection and forensic analysis.

Updated Aug 27, 2026
Search Tags:#cybersecurity#incident response#threat hunting#forensics#malware analysis#DFIR
One-click install
npx skills add https://github.com/defconxt/CIPHER --skill incident-response-defconxt
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Incident Response
Source: https://github.com/defconxt/CIPHER/tree/main/skills/incident-response
Command: npx skills add https://github.com/defconxt/CIPHER --skill incident-response-defconxt

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides immediate, actionable guidance and commands for responding to cybersecurity incidents, helping security professionals contain threats, collect evidence, and reconstruct timelines efficiently.

Core Features & Use Cases

  • Volatile Data Collection: Guides on the correct order and commands for capturing live system memory, processes, and network states.
  • Forensic Artifact Analysis: Details locations and parsing methods for critical Windows, Linux, and macOS artifacts.
  • Network Forensics: Offers Wireshark/tshark filters and BPF syntax for identifying malicious network activity.
  • Containment & Eradication: Provides strategies for isolating compromised systems and accounts.
  • Timeline Reconstruction: Lists key log sources and tools like Plaso for building a chronological event sequence.
  • Incident Runbooks: Offers step-by-step playbooks for common scenarios like ransomware and Active Directory compromise.

Quick Start

Use the incident response skill to collect volatile data from a Linux system.

Frequently Asked Questions about Incident Response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I collect volatile data during an incident response on a live system?▼

Volatile data collection during incident response requires capturing live system memory, active processes, and network states in the correct forensic order using specific commands before any system changes occur.

Where can I find forensic artifacts for malware analysis on Windows, Linux, and macOS?▼

Forensic artifact analysis for malware analysis targets specific operating system locations across Windows, Linux, and macOS environments, utilizing defined parsing methods to extract evidence of malicious execution and persistence.

What is the best way to reconstruct a timeline of a cybersecurity incident?▼

Timeline reconstruction for cybersecurity incidents aggregates key log sources across systems and utilizes tools like Plaso to build a chronological sequence of events, revealing the attacker's activity sequence.

What Wireshark filters should I use for network forensics to identify malicious activity?▼

Network forensics utilizes specific Wireshark and tshark filters alongside BPF syntax to isolate, capture, and identify malicious network activity and communications from compromised hosts.

Are there incident response runbooks for specific attack scenarios like ransomware?▼

Incident response runbooks provide step-by-step playbooks for common attack scenarios, specifically detailing containment, eradication, and recovery strategies for ransomware and Active Directory compromises.

What strategies should I use for containment and eradication of compromised systems?▼

Containment and eradication strategies focus on isolating compromised systems and accounts to prevent lateral movement, utilizing specific techniques to remove threats while preserving forensic evidence.

Related Skills

Explore More Software Engineering Skills→
haxlyshaxlys

memory-forensics

Analyze volatile memory artifacts with Volatility 3 across Windows, Linux, and macOS.

Community
Advanced
Liberty91LTDLiberty91LTD
15

ioc-export

Export IOC collections to CSV, STIX 2.1, OpenIOC, and MISP bundles.

Official
Intermediate
SherifEldeebSherifEldeeb
5

memory-forensics

Analyze volatile memory dumps for malware and rootkits using Volatility 3.

Community
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced