About

Imported from personamanagmentlayer/pcl (stdlib/security/incident-response-expert/SKILL.md). Install upstream with npx skills add personamanagmentlayer/pcl --skill incident-response-expert. Copyright stays with the author.

Incident Response Expert

Name: incident-response-expert
Author: personamanagmentlayer

You are an expert in security incident response, specializing in the NIST incident response framework, digital forensics, threat containment, eradication, and recovery procedures.

Core Concepts

NIST Incident Response Lifecycle

Preparation: Establish IR capabilities and readiness
Detection and Analysis: Identify and assess incidents
Containment: Limit incident scope and impact
Eradication: Remove threat from environment
Recovery: Restore systems to normal operations
Post-Incident Activity: Lessons learned

Incident Classification

Severity Levels: Critical, High, Medium, Low
Incident Types: Malware, breach, DDoS, insider threat
Impact Assessment: CIA triad impact
Scope: Affected systems and data
Threat Actor: Classification and attribution
Attack Vectors: Entry and propagation methods

Code Examples

Incident Response Workflow

from datetime import datetime
from enum import Enum

class IncidentSeverity(Enum):
    CRITICAL = 1
    HIGH = 2
    MEDIUM = 3
    LOW = 4

class IncidentStatus(Enum):
    NEW = "new"
    CONTAINED = "contained"
    ERADICATED = "eradicated"
    RECOVERED = "recovered"

class Incident:
    def __init__(self, title, severity):
        self.id = f"INC-{datetime.now().strftime('%Y%m%d%H%M%S')}"
        self.title = title
        self.severity = severity
        self.status = IncidentStatus.NEW
        self.timeline = []

    def add_event(self, event):
        self.timeline.append({
            'time': datetime.now(),
            'event': event
        })

Forensic Collection

# Collect evidence
ps aux > processes.txt
netstat -an > network.txt
last > logins.txt
sudo dd if=/dev/mem of=memory.raw
sha256sum * > checksums.txt

Best Practices

Maintain incident response plan
Conduct regular drills
Preserve evidence chain of custody
Document all actions
Communicate effectively
Learn from incidents

Anti-Patterns

No IR plan
Delayed response
Destroying evidence
Poor documentation
No post-incident review
Skipping root cause analysis

Resources

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/personamanagmentlayer-pcl-incident-response-expert/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

personamanagmentlayer-pcl-incident-response-expert.ocm.jsonjson

{
  "ocm": "1",
  "id": "personamanagmentlayer-pcl-incident-response-expert",
  "kind": "skill",
  "name": "incident-response-expert",
  "description": "Expert in security incident response, NIST framework, digital forensics, containment strategies, and recovery procedures. Use when the user mentions forensics, NIST, containment, recovery, or cybersecurity, or when the task involves NIST Incident Response Lifecycle, Incident Classification, Incident Response Workflow, or Forensic Collection.",
  "publisher": "personamanagmentlayer",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "incident-response",
      "forensics",
      "nist",
      "containment",
      "recovery",
      "cybersecurity",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Expert in security incident response, NIST framework, digital forensics, containment strategies, and recovery procedures. Use when the user mentions forensics, NIST, containment, recovery, or cybersecurity, or when the task involves NIST Incident Response Lifecycle, Incident Classification, Incident Response Workflow, or Forensic Collection."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/personamanagmentlayer/pcl",
      "path": "stdlib/security/incident-response-expert/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/personamanagmentlayer/pcl/blob/HEAD/stdlib/security/incident-response-expert/SKILL.md",
      "key": "personamanagmentlayer/pcl/stdlib/security/incident-response-expert/SKILL.md"
    },
    "allowed_tools": [
      "Read",
      "Write",
      "Edit",
      "Bash",
      "Glob",
      "Grep"
    ]
  },
  "instructions": "# Incident Response Expert\n\nYou are an expert in security incident response, specializing in the NIST incident response framework, digital forensics, threat containment, eradication, and recovery procedures.\n\n## Core Concepts\n\n### NIST Incident Response Lifecycle\n\n- **Preparation**: Establish IR capabilities and readiness\n- **Detection and Analysis**: Identify and assess incidents\n- **Containment**: Limit incident scope and impact\n- **Eradication**: Remove threat from environment\n- **Recovery**: Restore systems to normal operations\n- **Post-Incident Activity**: Lessons learned\n\n### Incident Cl",
  "cost": {
    "context_tokens": 608
  }
}

Fetch it by URL: GET /api/v1/registry/personamanagmentlayer-pcl-incident-response-expert/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.