security-recommended-actions

To generate an incident response plan, input the threat type, severity, and affected assets. The skill produces phased, action-ready tasks for containment, eradication, and recovery with assigned owners and timelines.

Security incident containment and recovery involve phased actions: initial triage, containment to limit spread, eradication of the threat, recovery of systems, and post-incident review. The skill structures these steps with playbook alignment.

Yes, you can map incident response actions to MITRE ATT&CK techniques. The skill generates threat-specific guidance that aligns containment and eradication steps with relevant MITRE ATT&CK mappings for escalations.

You can assign role-based ownership and timelines by generating actionable tasks through the skill. It produces structured incident records that specify owners, timelines, and documentation requirements for evidence preservation.

Yes, this approach supports post-incident reviews and escalations. The skill applies its phased action generation to new incidents, escalations, and post-incident reviews, ensuring consistent documentation and recovery steps.

The best way to document evidence preservation is to use structured, phased response actions. The skill satisfies evidence preservation requirements by generating actionable tasks and documentation that can be loaded into incident records.