responding-to-security-incidents

Security incident response involves classifying the breach type and severity, then executing a structured playbook for containment, eradication, and recovery. This skill guides you through incident classification, generates tailored response steps, and helps collect forensic evidence to minimize damage and prevent recurrence.

Immediate ransomware response prioritizes containment by isolating affected systems, then eradication by removing the malware, followed by recovery from backups. This skill generates a detailed playbook with specific containment, eradication, and recovery steps tailored to your incident.

Evidence gathering during incident response requires collecting logs, network data, and forensic artifacts while maintaining chain of custody. This skill provides structured guidance on what evidence to collect, how to preserve it, and how to integrate collection with logging, forensic tools, and ticketing workflows.

Yes, incident response applies across attack types including DDoS, ransomware, and data breaches. This skill classifies each incident type, generates appropriate response playbooks, and guides remediation steps specific to the attack's nature and scope.

Post-incident analysis examines what happened, why it happened, and what prevents recurrence. This skill guides post-incident review, helps document lessons learned, and integrates findings with logging and ticketing systems to strengthen future defenses.