Security Incident Responder

概要

The Security Incident Responder skill empowers developers and security teams to handle breaches and attacks with a structured, professional framework. It assists in classifying incident types—such as ransomware, DDoS, or data breaches—and generates tailored playbooks for containment, eradication, and recovery. By providing guidance on evidence preservation and remediation planning, this skill ensures that security events are managed effectively while minimizing damage and supporting future forensic investigations.

主な機能

• Dynamic generation of containment and recovery playbooks
• Post-incident report generation and timeline construction
• Step-by-step remediation planning for exploited vulnerabilities
• Automated incident classification and severity assessment
• Guidance for forensic evidence collection and log analysis
• 883 GitHub stars

ユースケース

• Investigating a suspected data breach to determine the scope of compromised information
• Responding to an active ransomware attack by isolating systems and planning restoration
• Developing and testing organizational security incident response plans