incident_response

Security incident response coordination involves classifying the attack, generating a tailored containment playbook, gathering forensic evidence, and planning recovery. This skill automates that workflow from identification through eradication and follow-up based on NIST and SANS best practices.

Classifying security incidents requires determining the event type, severity level, and affected scope. This skill automates incident classification to ensure appropriate response prioritization and generates tailored playbooks for containment, eradication, and recovery.

Incident response playbook generation creates tailored action plans for containment, eradication, and recovery phases. The skill validates these response strategies against best practices from NIST SP 800-61 Rev. 2 and the SANS Incident Handler's Handbook to ensure compliance.

No external compliance framework installation is required. The skill internally validates response strategies against NIST SP 800-61 Rev. 2 and the SANS Incident Handler's Handbook, embedding those best practices directly into its automated preparation, identification, and remediation workflows.

Automating forensic evidence gathering guides the collection of logs, network data, and other forensic artifacts during a security incident. The skill supports automated workflows across preparation, identification, containment, eradication, recovery, and follow-up stages.

Automated incident response playbooks are ideal when a structured approach is needed to minimize damage and prevent future occurrences. Use it when you need to validate strategies against NIST and SANS standards while coordinating classification, evidence gathering, and remediation systematically.