skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

triaging-security-incident-with-ir-playbook

Classify and prioritize security alerts using IR playbooks, severity scoring, and team escalation.

954|172|Updated Mar 13, 2026
Search Tags:#playbook#incident response#triage#threat intelligence#siem#SoC#severity classification
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill triaging-security-incident-with-ir-playbook
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: triaging-security-incident-with-ir-playbook
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/incident-response/triaging-security-incident-with-ir-playbook
Command: npx skills add https://github.com/xalgord/xalgorix --skill triaging-security-incident-with-ir-playbook

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

SOC analysts face a constant stream of SIEM and EDR alerts and must quickly decide which are true positives, how severe they are, and who should respond. This Skill provides a structured triage workflow that enriches alerts, classifies incident types, assigns severity, and routes incidents to the right playbook and response team.

Core Features & Use Cases

  • Alert Enrichment: Query VirusTotal, AbuseIPDB, and internal CMDB systems to add reputation and asset-criticality context to raw alerts.
  • Severity Classification: Apply a weighted scoring matrix (asset criticality, data sensitivity, scope, threat status) to assign P1-P4 priority levels.
  • Playbook Selection & Escalation: Map alerts to incident-type playbooks, create cases in TheHive, and page responders via PagerDuty based on severity.
  • Use Case: A brute-force alert fires in Splunk. Use this Skill to enrich the source IP, correlate 30 days of related activity, score the severity, and open a TheHive case with the correct playbook assigned.

Quick Start

Triage this new critical Splunk alert by enriching the source IP, classifying the incident type, assigning a severity level, and creating a TheHive case with the matching playbook.

Frequently Asked Questions about triaging-security-incident-with-ir-playbook

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I triage a security incident from a SIEM alert?▼

Start by acknowledging the alert in the SIEM, then enrich indicators with VirusTotal and AbuseIPDB, classify the incident type against playbook trigger conditions, score severity using asset criticality and threat status, and create a case in TheHive with the matching playbook.

How to assign severity levels to security incidents?▼

Use a weighted scoring matrix combining asset criticality, data sensitivity, scope of affected systems, and whether the threat is active. Scores of 12 or higher map to P1/Critical, 9-11 to P2/High, 6-8 to P3/Medium, and below 6 to P4/Low.

What tools are needed for security incident triage?▼

The workflow uses a SIEM such as Splunk, Elastic, QRadar, or Sentinel for alert correlation, TheHive for case management, VirusTotal and AbuseIPDB for IOC enrichment, PagerDuty for on-call escalation, and MITRE ATT&CK for technique classification.

Why do clean VirusTotal results not downgrade an alert?▼

Newly registered C2 domains and fast-flux infrastructure often have zero detections, so a clean reputation score is not proof of safety. Severity should be validated against asset criticality, data classification, and whether the threat is active rather than reputation alone.

When should a security alert be escalated to PagerDuty?▼

Escalate P1/Critical incidents to the IR lead, senior analysts, and CISO, and P2/High incidents to the IR lead and available analysts. P3 incidents go to the next available analyst and P4 alerts queue for business-hours processing.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

triaging-security-incident

Automate security incident triage using NIST SP 800-61r3 and SANS PICERL frameworks.

Official
Advanced
AbsolutelySkilledAbsolutelySkilled
207

security-incident-response

Detect, contain, and recover from security incidents using structured IR phases.

Official
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
AxxxxxxaaannAxxxxxxaaann

automating-ioc-enrichment

Enrich raw indicators of compromise with multi-source threat intelligence context.

Community
Advanced