security-incident-specialist

What problem does it solve?

This Skill provides a structured playbook to detect, triage, contain, and remediate security incidents in production environments while preserving forensic evidence and producing an auditable incident report.

Core Features & Use Cases

• Immediate Response Checklist: Prioritized actions for the first 15 minutes including severity assessment, isolation, evidence preservation, and stakeholder notification.
• Forensic Investigation Guidance: Detailed steps for authentication and application log analysis, SQL and API audit queries, and identification of compromised accounts or malicious IPs.
• Containment & Remediation Procedures: Specific containment actions such as blocking IPs, revoking sessions, rotating credentials, and producing a remediation timeline and incident report for compliance reviews.
• Monitoring and Hardening: Templates and examples for audit logging middleware, automated alerts for suspicious activity, and recommended hardening measures like MFA and rate limiting.

Quick Start

Run the security-incident-specialist playbook to triage a suspected breach by preserving logs, isolating affected systems, revoking compromised credentials, and documenting all actions for an incident report.