security-incident-reporting

What problem does it solve?

This Skill provides a structured framework to document and analyze security incidents using NIST SP 800-61 and SANS-based templates, enabling consistent post-mortems, audits, and stakeholder communications.

Core Features & Use Cases

• Incident reporting templates: metadata, timeline, IoCs, root-cause analysis, and remediation sections aligned with industry best practices.
• CVE correlation & classification: map observed indicators to known CVEs for threat intelligence integration.
• Post-incident playbooks: pre-built runbooks, checklists, and escalation paths to streamline containment and recovery.

Quick Start

Create a Security Incident Report for a detected event, including a metadata section, incident timeline, IoCs, and suggested remediation steps.