skills.rest
briiirussell
briiirussellCOMMUNITY
Explore all skills by this author →
GitHub

incident-triage

Classify security incidents and produce initial triage plans with NIST SP 800-61r2 methodology.

345|47|Updated Mar 13, 2026
Search Tags:#incident response#triage#containment#NIST SP 800-61#IOC extraction#forensics readiness#SOC operations
One-click install
npx skills add https://github.com/briiirussell/cybersecurity-skills --skill incident-triage-briiirussell
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident-triage
Source: https://github.com/briiirussell/cybersecurity-skills/tree/main/skills/incident-triage
Command: npx skills add https://github.com/briiirussell/cybersecurity-skills --skill incident-triage-briiirussell

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It helps you quickly classify a security incident, contain it safely, preserve evidence, and produce an actionable initial triage plan aligned to NIST SP 800-61.

Core Features & Use Cases

  • Incident classification & severity: Identify malware, unauthorized access, exfiltration, DoS, web compromise, and phishing/social engineering, then assign severity (Critical/High/Medium/Low).
  • Safe initial containment actions: Choose containment steps that prioritize human safety, limit spread, and preserve volatile evidence (including guidance not to power off systems when volatile memory is important).
  • Evidence preservation & IOC extraction: Capture artifacts in order of volatility, document analysis findings, and extract indicators of compromise to support downstream analysis and reporting.

Use case example: When your SOC flags suspicious activity that could indicate credential compromise, use this skill to rapidly determine likely incident type and severity, isolate affected hosts, preserve relevant logs/process/network evidence, and output an incident triage report with IOCs for follow-on investigation.

Quick Start

Use the incident-triage skill when you need to triage a suspected security incident and produce an initial containment-and-evidence plan.

Frequently Asked Questions about incident-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a security incident and classify its severity?▼

To triage a security incident, classify it by type—such as malware, unauthorized access, or data exfiltration—and assign a severity level of Critical, High, Medium, or Low to prioritize initial response actions.

What is the best way to contain a security incident without destroying volatile evidence?▼

The best way to contain an incident safely is to prioritize human safety and limit spread without destroying volatile evidence, specifically avoiding powering off systems when memory capture is necessary for forensics.

How does NIST SP 800-61 incident response methodology apply to SOC triage workflows?▼

NIST SP 800-61 methodology applies to SOC triage by providing a structured process to classify incidents, guide safe containment actions, preserve forensic evidence, and extract IOCs for downstream investigation.

When do I need to extract IOCs and capture artifacts in order of volatility?▼

You need to extract IOCs and capture artifacts by volatility during initial incident response to preserve forensic evidence, document findings, and support downstream SOC analysis and reporting.

Can I use this incident triage process for phishing and web compromise investigations?▼

Yes, you can use this incident triage process for phishing and web compromise investigations, as it supports classification and initial response workflows for malware, unauthorized access, DoS, and social engineering.

What are the limitations of initial incident containment during a suspected credential compromise?▼

Initial incident containment focuses on limiting damage and isolating hosts but does not complete the investigation, requiring downstream SOC handoff to analyze preserved evidence and extracted IOCs fully.

Related Skills

Explore More Legal & Compliance Skills→
diegosouzapwdiegosouzapw
108

observability-review

Audit logs, metrics, traces, and alerts to ensure cohesive telemetry.

Community
Advanced
weirdgmeweirdgme
4

cybersecurity

Provide cybersecurity guidance for architecture, threat modeling, and incident response.

Community
Basic
daemon-blockint-techdaemon-blockint-tech
7

defensive-security-analyst

Guide alert triage, investigation, and containment planning for SOC operations.

Community
Advanced
zenobi-uszenobi-us
68

incident-responder

Coordinate incident response for security breaches and operational incidents.

Official
Advanced