Security Incident Responder

概要

The Security Incident Responder skill equips Claude to handle the critical lifecycle of a security event, from initial containment to post-incident analysis. It provides structured guidance for investigating breaches like ransomware or data theft, assisting users in collecting forensic evidence, constructing attack timelines, and executing effective remediation strategies to restore systems and harden security posture. By following industry best practices, it ensures that incident response is methodical, helping to minimize damage and prevent future occurrences.

主な機能

• Dynamic generation of tailored incident response playbooks
• Detailed remediation planning and post-incident reporting
• Forensic evidence collection guidance for logs and network data
• 883 GitHub stars
• Attack timeline construction and root cause analysis
• Automated incident classification and severity assessment

ユースケース

• Investigating potential data breaches and identifying compromised assets
• Developing and testing organizational security incident response plans
• Managing and containing a live ransomware or DDoS attack