running-cloud-ir-runbook

What problem does it solve?

This Skill helps responders handle active or recent cloud security incidents without improvising the sequence of triage, evidence capture, containment, and recovery.

Core Features & Use Cases

• Cloud triage and evidence preservation for AWS, GCP, and Azure alerts such as GuardDuty, Security Command Center, and Defender for Cloud.
• Containment and blast-radius analysis for leaked credentials, suspicious cross-account access, public storage exposure, and compromised service identities.
• Comms and recovery guidance for internal updates, customer or regulator notifications when regulated data is involved, and lessons-learned documentation with owners and deadlines.

Quick Start

Ask the skill to walk a specific cloud incident from alert to recovery, and include the provider, triggering signal, affected identity, account or subscription, alert window, and whether regulated data may be involved.