skills.rest
Rohithdgrr
RohithdgrrCOMMUNITY
Explore all skills by this author →
GitHub

incident-response

Classifies security incidents, scores SEV1-SEV4 severity, and routes escalation with forensic evidence collection.

Updated Aug 14, 2026
Search Tags:#incident response#escalation#forensics#soc#mitre att&ck#severity classification#security triage
One-click install
npx skills add https://github.com/Rohithdgrr/REEK-uninstaller --skill incident-response-rohithdgrr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: incident-response
Source: https://github.com/Rohithdgrr/REEK-uninstaller/tree/main/.opencode/skills/incident-response
Command: npx skills add https://github.com/Rohithdgrr/REEK-uninstaller --skill incident-response-rohithdgrr

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? When a security alert fires, teams must quickly decide whether it is a real incident, how severe it is, who to escalate to, and what evidence to preserve — all while regulatory notification clocks (GDPR 72 hours, PCI 24 hours) are already ticking. This Skill standardizes that triage so incidents are classified consistently, false positives are filtered before paging leadership, and forensic evidence is collected in the correct order. ## Core Features & Use Cases - Automated incident triage: The incident_triage.py script classifies JSON security events into 14 incident types (ransomware, data exfiltration, credential compromise, etc.), maps them to MITRE ATT&CK techniques, and assigns SEV1-SEV4 severity with exit codes that signal response urgency. - False positive filtering and escalation routing: Five filter categories (CI/CD agents, test environments, scanners, batch jobs, whitelisted identities) suppress noise, while escalation triggers (ransomware note, exfiltration confirmed, domain controller access) automatically raise severity and route to the correct responders. - Forensic and regulatory guidance: DFRWS six-phase evidence collection with chain-of-custody requirements, plus a reference table of notification deadlines for GDPR, PCI-DSS, HIPAA, NY DFS, SEC, CCPA, NIS2, DORA, and more. - Use Case: A SIEM alert indicates possible ransomware on a production file server. Pipe the event JSON into the triage script with false-positive checking; it returns SEV1 classification, MITRE technique T1486, a 15-minute response SLA, war-room escalation to the CISO, and the volatile evidence collection steps to start immediately. ## Quick Start Ask the AI to triage a security event by running the incident triage script against your alert JSON with classification and false-positive checking enabled, then follow the returned severity, escalation path, and forensic steps.

Frequently Asked Questions about incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I classify a security incident and determine its severity?▼

Pass the security event as JSON to the incident triage script with the --classify flag. It matches the event against a 14-type taxonomy, assigns a default SEV1-SEV4 severity, applies dwell-time and escalation-trigger adjustments, and exits with code 2 for SEV1, 1 for SEV2, or 0 otherwise.

How do I filter false positive security alerts before escalating?▼

Run the triage script with the --false-positive-check flag. It scans the event for five indicator categories: CI/CD automation accounts, test or staging environments, known scanners like Nessus and Qualys, scheduled batch jobs, and whitelisted service identities, then flags matches for review before escalation.

What input format does the incident triage tool accept?▼

The tool accepts a JSON object via stdin or a file path with --input. Key fields include event_type, host, user, source_ip, timestamp, and raw_payload; it also reads first_seen/last_seen timestamps to compute dwell time and an iocs list for indicator analysis.

When does the GDPR breach notification clock start?▼

The GDPR 72-hour notification clock starts at incident discovery or declaration, not when the investigation completes. If scope is unclear at declaration, assume the most restrictive applicable deadline and confirm scope within the first response window.

What forensic evidence should be collected first during an incident?▼

Collect volatile evidence first: live memory, running processes, open network connections, logged-in users, and system time, since these are lost on reboot. Every artifact must be hashed with SHA-256 at acquisition and logged with timestamp, tool provenance, and investigator identity for chain of custody.

When should I not use automated incident triage classification?▼

Do not declare SEV1 from a single data source; corroborate with at least two independent signals before declaration. Automated classification is a triage aid, and containment actions like network isolation or credential revocation still require human approval before execution.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

triaging-security-incident

Automate security incident triage using NIST SP 800-61r3 and SANS PICERL frameworks.

Official
Advanced
yogiexyogiex

ec-ecih

Guides incident response decisions using the ECIH 9-stage lifecycle and NIST 800-61 frameworks.

Community
Advanced
drupadsachaniadrupadsachania

threat-hunting

Generate hypotheses and artifacts for MITRE ATT&CK-aligned threat hunting.

Community
Advanced
xalgordxalgord
954

building-incident-response-playbook

Creates structured incident response playbooks aligned with NIST SP 800-61r3 and SANS PICERL frameworks.

Community
Intermediate