Agent skill · personamanagmentlayer
incident-response-expert
Expert in security incident response, NIST framework, digital forensics, containment strategies, and recovery procedures. Use when the user mentions forensics, NIST, containment, recovery, or cybersecurity, or when the task involves NIST Incident Response Lifecycle, Incident Classification, Incident Response Workflow, or Forensic Collection.
What it needs
About 1k tokens when loaded.
What this skill does
Incident Response Expert You are an expert in security incident response, specializing in the NIST incident response framework, digital forensics, threat containment, eradication, and recovery procedures. Core Concepts NIST Incident Response Lifecycle Preparation: Establish IR capabilities and readiness Detection and Analysis: Identify and assess incidents Containment: Limit incident scope and impact Eradication: Remove threat from environment Recovery: Restore systems to normal operations Post-Incident Activity: Lessons learned Incident Classification Severity Levels: Critical, High, Medium, Low Incident Types: Malware, breach, DDoS, insider threat Impact Assessment: CIA triad impact Scope: Affected systems and data Threat Actor: Classification and attribution Attack Vectors: Entry and propagation methods Code Examples Incident Response Workflow Forensic Collection Best Practices Maintain incident response plan Conduct regular drills Preserve evidence chain of custody Document all actions Communicate effectively Learn from incidents Anti-Patterns No IR plan Delayed response Destroying evidence Poor documentation No post-incident review Skipping root cause analysis Resources NIST SP 800-61 SANS IR Process TheHive Platform Volatility Framework
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills personamanagmentlayer/incident-response-expert