SKILL.md
Security Incident Response Skill
In a security incident, the order of operations matters: contain before you clean, preserve evidence before you wipe, and communicate deliberately. This skill drives a structured response through the standard phases, or documents one after the fact — with the immediate actions, decision points, comms, and a blameless post-incident review. For systems you own or are authorized to defend.
Required Inputs
Ask for these only if they aren't already provided:
- What's happening — the observed incident (malware, unauthorized access, data exfiltration, ransomware, account compromise), and how it was detected.
- Scope so far — affected systems/accounts/data, whether it's ongoing, entry point if known.
- Environment & stakes — what's at risk (PII, funds, availability), regulatory/notification obligations.
- Resources — who's responding, tooling/access available, and any IR plan already in place.
Output Format
Incident response: [incident]
Severity & summary — classify severity (e.g. SEV1–3) and state, in two lines, what's known and what's at stake.
Phase-by-phase actions:
- Triage & declare — confirm it's a real incident, assign severity and an incident lead, start a timeline/log.
- Contain — stop the bleeding without destroying evidence: isolate hosts, revoke sessions/keys, block IOCs, disable compromised accounts. Preserve forensic data (snapshots, logs, memory) before wiping.
- Eradicate — remove the root cause: close the entry point, remove malware/backdoors, patch the exploited flaw, rotate all potentially exposed credentials/secrets.
- Recover — restore from known-good, verify integrity, monitor closely for recurrence, return to normal service deliberately.
- Post-incident — a blameless review: timeline, root cause, what worked/didn't, and action items to prevent recurrence.
Communications — who to notify and when: internal (leadership, legal), customers, and any obligations (with the clock — many have strict deadlines). Draft the holding line.