ir-playbook

Name: ir-playbook
Availability: InStock
Author: UnitOne

Execute structured incident response workflows with NIST SP 800-61 Rev 2 and SANS mapping.

44|128|Updated Mar 6, 2026

Search Tags:#incident response #security operations #incident classification #nist sp 800-61 #containment decision tree #evidence preservation #stakeholder notification

Ready to run

npx skills add https://github.com/UnitOneAI/SecuritySkills --skill ir-playbook-unitoneai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ir-playbook
Source: https://github.com/UnitOneAI/SecuritySkills/tree/main/skills/incident-response/ir-playbook
Command: npx skills add https://github.com/UnitOneAI/SecuritySkills --skill ir-playbook-unitoneai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill turns incident response from improvised reaction into a structured, auditable workflow that produces consistent plans aligned to NIST SP 800-61 Rev 2 and the SANS Incident Handler’s Handbook.

Core Features & Use Cases

Incident triage and classification: Determines incident category and severity using NIST guidance (functional impact, information impact, recoverability).
Containment decisioning: Provides a containment strategy via a decision tree that balances urgency and business impact, including special handling for wiper/destructive malware.
Operational reporting output: Generates an incident response report with standardized sections (executive summary, timeline, IOCs, containment actions, notifications, escalation decisions, and PIR handoff).

Quick Start

Use the ir-playbook skill and provide a target file or directory containing the incident details you want to classify and respond to.

Frequently Asked Questions about ir-playbook

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I classify incident severity using NIST SP 800-61 Rev 2?▼

Incident severity is classified by assessing functional impact, information impact, and recoverability inputs based on NIST SP 800-61 Rev 2 guidelines. This structured workflow evaluates these factors to determine a standardized severity level and incident category for active security alerts.

How do I decide on a containment strategy for destructive malware?▼

Containment strategy for destructive malware is determined using a decision tree that balances operational urgency against business impact. The workflow provides specific handling guidance for wiper and destructive threats to ensure rapid isolation while minimizing operational disruption.

What is the best way to document incident response notifications and escalation criteria?▼

Documenting incident notifications and escalation criteria requires a standardized operational report containing executive summaries, timelines, and stakeholder notification logs. This approach ensures all evidence preservation and escalation decisions are recorded in an auditable format aligned with SANS guidelines.

Can I use this incident response workflow for active user-reported security alerts?▼

Yes, this incident response workflow applies when an alert or user report indicates an active incident. It processes the provided incident details to classify the event, recommend containment, and generate a structured response plan without executing attacker-provided instructions.

Does incident response reporting automatically generate IOCs and post-incident handoff sections?▼

Incident response reporting generates output that includes standardized sections for IOCs, containment actions, and post-incident review (PIR) handoff. The report schema ensures all critical operational data and timelines are captured consistently for downstream analysis.

What are the limitations of using automated containment decision trees during an active incident?▼

Automated containment decision trees provide structured guidance but require accurate functional impact and recoverability inputs to function effectively. The workflow does not execute attacker-provided instructions, limiting its response actions to documented eradication and recovery recommendations.