skills.rest
jvsandhu
jvsandhuCOMMUNITY
Explore all skills by this author →
GitHub

incident_response

Coordinates security incident classification, containment, evidence gathering, and remediation planning.

Updated Jan 14, 2026
Search Tags:#security#playbook#remediation#incident response#nist#forensics#breach
One-click install
npx skills add https://github.com/jvsandhu/agentic-skills --skill incident-response-jvsandhu
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident_response
Source: https://github.com/jvsandhu/agentic-skills/tree/main/skills/incident_response
Command: npx skills add https://github.com/jvsandhu/agentic-skills --skill incident-response-jvsandhu

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security breaches demand fast, structured action, but teams often respond ad hoc, losing evidence and missing containment steps. This Skill guides the full incident response lifecycle so nothing critical is skipped under pressure. ## Core Features & Use Cases - Incident Classification: Determines incident type, severity (1-5), and scope to prioritize response efforts. - Playbook Generation: Produces tailored containment, eradication, and recovery steps based on NIST SP 800-61 and SANS guidance. - Evidence Gathering: Directs collection and preservation of firewall, IDS/IPS, and application logs for forensic and legal use. - Use Case: When hit with a ransomware attack, use this Skill to isolate affected systems, remove the malware, restore from backups, and produce a lessons-learned report. ## Quick Start Ask the agent to generate an incident response playbook for a suspected data breach on your customer database.

Frequently Asked Questions about incident_response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I respond to a ransomware attack?▼

Ransomware response starts with containment: isolate affected systems from the network to stop spread. Then eradicate the malware, restore systems from safe backups, and document root cause in a lessons-learned report.

How to create an incident response playbook?▼

An incident response playbook is generated by first classifying the incident type and severity, then outlining containment, eradication, and recovery steps. This Skill bases playbooks on NIST SP 800-61 and the SANS Incident Handler's Handbook.

What evidence should I collect during a data breach investigation?▼

Collect firewall logs, IDS/IPS logs, application logs, and network traffic data, then copy them to a secure location. Logs should be signed or hashed so they remain admissible for legal proceedings.

Does this incident response process follow NIST guidelines?▼

Yes, the workflow is sourced from NIST SP 800-61 Rev. 2 and the SANS Incident Handler's Handbook. It covers preparation, identification, containment, eradication, recovery, and post-incident reporting phases.

When should I not use an automated incident response playbook?▼

Playbooks provide structured guidance but cannot replace professional forensic analysts for legal proceedings or complex nation-state attacks. Use them for triage and coordination, and escalate to specialists when legal liability or advanced threats are involved.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

triaging-security-incident

Automate security incident triage using NIST SP 800-61r3 and SANS PICERL frameworks.

Official
Advanced
SanctifiedOpsSanctifiedOps
3

reputation-recovery-playbook

Automates crisis communications and credibility restoration after security incidents for crypto projects.

Community
Basic
bingookbingook

http2-specific-attacks

Exploit HTTP/2 protocol vulnerabilities including HPACK compression and stream multiplexing abuse.

Community
Advanced
Fabric-ProFabric-Pro
3

threat-hunting

Detect security threats, vulnerabilities, and suspicious patterns in applications and infrastructure.

Official
Basic