incident-response

Create structured incident records, timelines, evidence, and lessons learned.

5|Updated Jan 12, 2026

Search Tags:#documentation #timeline #playbook #evidence #incident #incident-response

Ready to run

npx skills add https://github.com/SherifEldeeb/agentskills --skill incident-response-sherifeldeeb

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: incident-response
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/cybersecurity/incident-response
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill incident-response-sherifeldeeb

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security teams document and coordinate incident response activities, including timeline construction, evidence tracking, and post-incident reporting, enabling faster containment and clearer communication.

Core Features & Use Cases

Incident Documentation: Create structured incident records with an audit trail across all phases (identification, containment, eradication, recovery, lessons learned).
Timeline & Playbooks: Build incident timelines, track actions, and document playbook execution for repeatable responses.
Evidence & Lessons Learned: Manage evidence custody and generate lessons learned reports to improve future responses.

Quick Start

To begin, initialize an Incident for a given incident ID, add affected systems and actions, build a timeline, and generate a formal IR report.

Frequently Asked Questions about incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I document an incident response timeline from detection to lessons learned?▼

To document an incident response timeline, initialize an Incident record, add affected systems and actions, build the timeline across detection, containment, eradication, and recovery, then generate a formal lessons learned report.

What is the best way to track evidence custody during incident response?▼

Tracking evidence custody during incident response is managed by logging artifacts within an EvidenceTracker, maintaining a structured audit trail of actions that preserves the chain of custody for post-incident reporting.

Can I use Python to automate incident playbook execution and reporting?▼

Yes, you can automate incident playbook execution and reporting using Python classes like PlaybookExecution and LessonsLearned, which structure responses and generate formal IR reports with a YAML frontmatter definition.

How do you create a structured incident record with an audit trail for security teams?▼

Creating a structured incident record with an audit trail involves initializing an Incident object, documenting actions across identification, containment, eradication, and recovery phases to enable faster containment and clearer communication.

What do I need to generate a formal IR report from incident timelines and playbooks?▼

To generate a formal IR report, you need an initialized Incident record with constructed timelines, documented playbook execution, and tracked evidence, which are compiled to produce the final post-incident review documentation.