Agent skill · security · alirezarezvani
incident-response
Handle a suspected security breach: triage, SEV1-SEV4 severity, escalation and forensic evidence, per NIST SP 800-61. Use whenever the user thinks they were hacked, sees suspicious activity or a leaked key. Outages: incident-commander.
Why this skill is useful
Adds an executable incident triage tool with specific commands for classification, severity scoring, and escalation that aren't commonly known.
What it needs
Requires python3 installed locally. About 9k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Incident Response Incident response skill for the full lifecycle from initial triage through forensic collection, severity declaration, and escalation routing. This is NOT threat hunting (see threat-detection) or post-incident compliance mapping (see governance/compliance-mapping) — this is about classifying, triaging, and managing declared security incidents. --- Table of Contents Overview Incident Triage Tool Incident Classification Severity Framework False Positive Filtering Forensic Evidence Collection Escalation Paths Regulatory Notification Obligations Workflows Anti-Patterns Cross-References --- Overview What This Skill Does This skill provides the methodology and tooling for incident triage and response — classifying security events into typed incidents, scoring severity, filtering false positives, determining escalation paths, and initiating forensic evidence collection under chain-of-custody controls. Distinction from Other Security Skills Skill Focus Approach ------- ------- ---------- incident-response (this) Active incidents Reactive — classify, escalate, collect evidence threat-detection Pre-incident hunting Proactive — find threats before alerts fire cloud-security Cloud posture assessment Preventive — IAM, S3, network misconfiguration red-team Offensive simulation Offensive — test detection and response capability Prerequisites A security event must be ingested before triage. Events can come from SIEM alerts, EDR detections, threat intel feeds, or user reports. The triage tool accepts JSON event payloads; see the input schema below. --- Incident Triage Tool The incidenttriage.py tool classifies events, checks false positives, scores severity, determines escalation, and performs forensic pre-analysis. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/incident-response--18c6cc