incident-triage

Name: incident-triage
Author: briiirussell

320stars36forks

How to install incident-triage?

briiirussell/cybersecurity-skills/incident-triage

$npx -y skills add briiirussell/cybersecurity-skills --skill incident-triage

Installs into the current project.

Summary

Guide rapid triage and initial response to security incidents following NIST SP 800-61 methodology. Use when the user mentions 'incident response,' 'security incident,' 'triage,' 'we've been hacked,' 'breach,' 'compromised,' 'malware detected,' 'suspicious activity,' 'IOC,' 'indi

Files · 1

View on GitHub

SKILL.md

1	# Incident Triage — Security Incident Response
2
3	Guide rapid triage and initial response to security incidents. Follow NIST SP 800-61 methodology.
4
5	Cross-references: `siem-detection` for the rules that produced the alert this triage is responding to, `disk-forensics` for deeper disk and memory analysis once a host is contained, `breach-patterns` for the post-incident pattern extraction that hardens against recurrence, `soc-operations` for the operational layer above this skill (runbooks, escalation, handoff), `security-comms` for the stakeholder / customer notifications the response generates, `privacy-engineering` / `hipaa-audit` / `pci-audit` for the regulatory-clock determination when personal data, PHI, or cardholder data is involved, `ai-risk-management` for AI-specific incident classes (model failure, fairness drift, jailbreak exploitation in production).
6
7	## Priorities (in order)
8
9	1. Preserve human safety
10	2. Contain the incident to prevent further damage
11	3. Preserve evidence for investigation
12	4. Identify root cause and scope
13	5. Document everything
14
15	## Step 1: Classification
16
17	Determine incident type:
18	- Malware: ransomware, trojan, worm, cryptominer
19	- Unauthorized access: compromised credentials, exploitation
20	- Data exfiltration: data theft, insider threat
21	- Denial of service
22	- Web compromise: defacement, skimming, backdoor
23	- Phishing / social engineering
24
25	Determine severity:
26	- Critical: active data exfiltration, ransomware spreading, critical system compromise
27	- High: confirmed compromise, malware detected, unauthorized access
28	- Medium: suspicious activity, potential indicators, failed attacks
29	- Low: policy violation, reconnaissance detected, likely false positive
30
31	## Step 2: Initial Containment
32
33	Based on type and severity:
34	- Network: block suspicious IPs/domains at firewall
35	- Host: isolate affected system (network disconnect, NOT power off — volatile memory is evidence)
36	- Account: disable compromised accounts, force password resets
37	- Application: disable affected service if safe to do so
38
39	Critical: Do NOT power off systems. Volatile memory contains evidence.
40
41	## Step 3: Evidence Preservation
42
43	Capture in order of volatility (most volatile first):
44
45	```bash
46	# 1. Running processes
47	ps auxf # Linux
48	tasklist /v # Windows
49
50	# 2. Network connections
51	ss -tupn # Linux
52	netstat -anob # Windows
53
54	# 3. Logged-in users
55	who -a # Linux
56	query user # Windows
57
58	# 4. Open files
59	lsof -nP # Linux
60
61	# 5. System logs
62	journalctl --since "1 hour ago" # Linux/systemd
63	```
64
65	If memory forensics tools are available (LiME, WinPmem), capture a memory dump before anything else.
66
67	## Step 4: Initial Analysis
68
69	For each suspicious indicator, document:
70	- What: describe the artifact
71	- When: timestamps in UTC
72	- Where: affected system(s)
73	- How: how it was detected
74
75	Common analysis:
76	- Process tree: look for unusual process names, paths, or parent-child relationships
77	- Network indicators: unusual outbound connections, DNS queries to suspicious domains, beaconing patterns (regular intervals)
78	- File indicators: recently modified files in unusual locations, hidden files, new executables
79	- Log analysis: authentication failures, privilege escalation, service changes, cleared logs
80	- Persistence: crontab, systemd units, registry Run keys, scheduled tasks, startup items
81
82	## Step 5: IOC Extraction
83
84	Extract and document all indicators of compromise:
85
86	\| Type \| Examples \|
87	\|------\|---------\|
88	\| IP addresses \| Source and destination IPs \|
89	\| Domains \| C2 domains, phishing domains \|
90	\| File hashes \| MD5 and SHA256 of suspicious files \|
91	\| File paths \| Malware locations, dropped files \|
92	\| Email addresses \| Phishing sender addresses \|
93	\| URLs \| Malicious URLs, C2 endpoints \|
94	\| User agents \| Unusual or known-malicious user agents \|
95
96	## Output Format
97
98	```markdown
99	# Incident Triage Report
100	## Incident ID: [ID]
101	## Date/Time: [UTC]
102	## Severity: [Critical/High/Medium/Low]
103	## Classification: [incident type]
104	## Status: [Triage/Contained/Analyzing/Resolved]
105
106	### Summary
107	[2-3 sentence overview]
108
109	### Affected Systems
110	\| Hostname \| IP \| Role \| Status \|
111	\|----------\|-----\|------\|--------\|
112
113	### Timeline
114	\| Time (UTC) \| Event \| Source \| Notes \|
115	\|------------\|-------\|--------\|-------\|
116
117	### Indicators of Compromise
118	\| Type \| Value \| Context \| Confidence \|
119	\|------\|-------\|---------\|------------\|
120
121	### Containment

People who liked this also viewed

6 picks

Type

incident-triage

320stars36forks

View on GitHub

How to install incident-triage?

briiirussell/cybersecurity-skills/incident-triage

$npx -y skills add briiirussell/cybersecurity-skills --skill incident-triage

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Incident Triage — Security Incident Response
2
3	Guide rapid triage and initial response to security incidents. Follow NIST SP 800-61 methodology.
4
5	Cross-references: `siem-detection` for the rules that produced the alert this triage is responding to, `disk-forensics` for deeper disk and memory analysis once a host is contained, `breach-patterns` for the post-incident pattern extraction that hardens against recurrence, `soc-operations` for the operational layer above this skill (runbooks, escalation, handoff), `security-comms` for the stakeholder / customer notifications the response generates, `privacy-engineering` / `hipaa-audit` / `pci-audit` for the regulatory-clock determination when personal data, PHI, or cardholder data is involved, `ai-risk-management` for AI-specific incident classes (model failure, fairness drift, jailbreak exploitation in production).
6
7	## Priorities (in order)
8
9	1. Preserve human safety
10	2. Contain the incident to prevent further damage
11	3. Preserve evidence for investigation
12	4. Identify root cause and scope
13	5. Document everything
14
15	## Step 1: Classification
16
17	Determine incident type:
18	- Malware: ransomware, trojan, worm, cryptominer
19	- Unauthorized access: compromised credentials, exploitation
20	- Data exfiltration: data theft, insider threat
21	- Denial of service
22	- Web compromise: defacement, skimming, backdoor
23	- Phishing / social engineering
24
25	Determine severity:
26	- Critical: active data exfiltration, ransomware spreading, critical system compromise
27	- High: confirmed compromise, malware detected, unauthorized access
28	- Medium: suspicious activity, potential indicators, failed attacks
29	- Low: policy violation, reconnaissance detected, likely false positive
30
31	## Step 2: Initial Containment
32
33	Based on type and severity:
34	- Network: block suspicious IPs/domains at firewall
35	- Host: isolate affected system (network disconnect, NOT power off — volatile memory is evidence)
36	- Account: disable compromised accounts, force password resets
37	- Application: disable affected service if safe to do so
38
39	Critical: Do NOT power off systems. Volatile memory contains evidence.
40
41	## Step 3: Evidence Preservation
42
43	Capture in order of volatility (most volatile first):
44
45	```bash
46	# 1. Running processes
47	ps auxf # Linux
48	tasklist /v # Windows
49
50	# 2. Network connections
51	ss -tupn # Linux
52	netstat -anob # Windows
53
54	# 3. Logged-in users
55	who -a # Linux
56	query user # Windows
57
58	# 4. Open files
59	lsof -nP # Linux
60
61	# 5. System logs
62	journalctl --since "1 hour ago" # Linux/systemd
63	```
64
65	If memory forensics tools are available (LiME, WinPmem), capture a memory dump before anything else.
66
67	## Step 4: Initial Analysis
68
69	For each suspicious indicator, document:
70	- What: describe the artifact
71	- When: timestamps in UTC
72	- Where: affected system(s)
73	- How: how it was detected
74
75	Common analysis:
76	- Process tree: look for unusual process names, paths, or parent-child relationships
77	- Network indicators: unusual outbound connections, DNS queries to suspicious domains, beaconing patterns (regular intervals)
78	- File indicators: recently modified files in unusual locations, hidden files, new executables
79	- Log analysis: authentication failures, privilege escalation, service changes, cleared logs
80	- Persistence: crontab, systemd units, registry Run keys, scheduled tasks, startup items
81
82	## Step 5: IOC Extraction
83
84	Extract and document all indicators of compromise:
85
86	\| Type \| Examples \|
87	\|------\|---------\|
88	\| IP addresses \| Source and destination IPs \|
89	\| Domains \| C2 domains, phishing domains \|
90	\| File hashes \| MD5 and SHA256 of suspicious files \|
91	\| File paths \| Malware locations, dropped files \|
92	\| Email addresses \| Phishing sender addresses \|
93	\| URLs \| Malicious URLs, C2 endpoints \|
94	\| User agents \| Unusual or known-malicious user agents \|
95
96	## Output Format
97
98	```markdown
99	# Incident Triage Report
100	## Incident ID: [ID]
101	## Date/Time: [UTC]
102	## Severity: [Critical/High/Medium/Low]
103	## Classification: [incident type]
104	## Status: [Triage/Contained/Analyzing/Resolved]
105
106	### Summary
107	[2-3 sentence overview]
108
109	### Affected Systems
110	\| Hostname \| IP \| Role \| Status \|
111	\|----------\|-----\|------\|--------\|
112
113	### Timeline
114	\| Time (UTC) \| Event \| Source \| Notes \|
115	\|------------\|-------\|--------\|-------\|
116
117	### Indicators of Compromise
118	\| Type \| Value \| Context \| Confidence \|
119	\|------\|-------\|---------\|------------\|
120
121	### Containment

People who liked this also viewed

6 picks

Type