skills.rest
SherifEldeeb
SherifEldeebCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

incident-response

Create structured incident records, timelines, evidence, and lessons learned.

5|Updated Jan 12, 2026
Search Tags:#documentation#timeline#playbook#evidence#incident#incident-response
One-click install
npx skills add https://github.com/SherifEldeeb/agentskills --skill incident-response-sherifeldeeb
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident-response
Source: https://github.com/SherifEldeeb/agentskills/tree/main/skills/cybersecurity/incident-response
Command: npx skills add https://github.com/SherifEldeeb/agentskills --skill incident-response-sherifeldeeb

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps security teams document and coordinate incident response activities, including timeline construction, evidence tracking, and post-incident reporting, enabling faster containment and clearer communication.

Core Features & Use Cases

  • Incident Documentation: Create structured incident records with an audit trail across all phases (identification, containment, eradication, recovery, lessons learned).
  • Timeline & Playbooks: Build incident timelines, track actions, and document playbook execution for repeatable responses.
  • Evidence & Lessons Learned: Manage evidence custody and generate lessons learned reports to improve future responses.

Quick Start

To begin, initialize an Incident for a given incident ID, add affected systems and actions, build a timeline, and generate a formal IR report.

Frequently Asked Questions about incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I document an incident response timeline from detection to lessons learned?▼

To document an incident response timeline, initialize an Incident record, add affected systems and actions, build the timeline across detection, containment, eradication, and recovery, then generate a formal lessons learned report.

What is the best way to track evidence custody during incident response?▼

Tracking evidence custody during incident response is managed by logging artifacts within an EvidenceTracker, maintaining a structured audit trail of actions that preserves the chain of custody for post-incident reporting.

Can I use Python to automate incident playbook execution and reporting?▼

Yes, you can automate incident playbook execution and reporting using Python classes like PlaybookExecution and LessonsLearned, which structure responses and generate formal IR reports with a YAML frontmatter definition.

How do you create a structured incident record with an audit trail for security teams?▼

Creating a structured incident record with an audit trail involves initializing an Incident object, documenting actions across identification, containment, eradication, and recovery phases to enable faster containment and clearer communication.

What do I need to generate a formal IR report from incident timelines and playbooks?▼

To generate a formal IR report, you need an initialized Incident record with constructed timelines, documented playbook execution, and tracked evidence, which are compiled to produce the final post-incident review documentation.

Related Skills

Explore More Education & Research Skills→
vadimcomanescuvadimcomanescu
24

senior-secops

Automate security operations triage and incident response workflows.

Community
Intermediate
AbsolutelySkilledAbsolutelySkilled
207

security-incident-response

Detect, contain, and recover from security incidents using structured IR phases.

Official
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced
SeanHoggSeanHogg
3

notion

Manage Notion pages, databases, and blocks via the Notion API.

Community
Intermediate