Agent-Skills.md

Agent Skills: Security Incident Playbook Generator

Creates response procedures for security incidents with containment steps, communication templates, and evidence collection. Use for "incident response", "security playbook", "breach response", or "IR plan".

UncategorizedID: patricio0312rev/skillset/security-incident-playbook-generator

Repository

patricio0312rev/skillset
patricio0312revLicense: MIT
6

Install this agent skill to your local

pnpm dlx add-skill https://github.com/patricio0312rev/skillset/tree/HEAD/templates/security/security-incident-playbook-generator

Skill Files

Browse the full folder contents for security-incident-playbook-generator.

Download Skill

Loading file tree…

templates/security/security-incident-playbook-generator/SKILL.md

Skill Metadata

Name
security-incident-playbook-generator
Description
Creates response procedures for security incidents with containment steps, communication templates, and evidence collection. Use for "incident response", "security playbook", "breach response", or "IR plan".

Security Incident Playbook Generator

Prepare for security incidents with structured response plans.

Incident Response Phases

# Security Incident Response Playbook

## Phase 1: Detection & Triage (0-15 min)

### Detection Sources

- Security alerts (CloudWatch, Sentry)
- User reports
- Anomaly detection
- Penetration test findings

### Initial Assessment

- [ ] Identify incident type
- [ ] Assess severity (P0-P3)
- [ ] Determine scope
- [ ] Alert on-call security

## Phase 2: Containment (15-60 min)

### Immediate Actions

- [ ] Isolate affected systems
- [ ] Revoke compromised credentials
- [ ] Block malicious IPs
- [ ] Enable enhanced monitoring

### Evidence Preservation

- [ ] Capture logs
- [ ] Take system snapshots
- [ ] Document timeline
- [ ] Preserve artifacts

## Phase 3: Eradication (1-24 hours)

- [ ] Remove malware
- [ ] Close vulnerabilities
- [ ] Reset passwords
- [ ] Update firewall rules

## Phase 4: Recovery (24-72 hours)

- [ ] Restore from backup
- [ ] Verify system integrity
- [ ] Resume operations
- [ ] Monitor for reinfection

## Phase 5: Post-Incident (1 week)

- [ ] Document lessons learned
- [ ] Update procedures
- [ ] Security training
- [ ] Notify affected users (if required)

Output Checklist

  • [ ] Response phases defined
  • [ ] Containment procedures
  • [ ] Communication templates
  • [ ] Evidence collection rules
  • [ ] Post-incident review ENDFILE