Incident Response Kit

Ad-hoc incident response often fails due to lost volatile evidence, poor documentation, and inconsistent steps. This skill provides a structured framework to handle compromises from the first 15 minutes through to the final board-ready report. It enforces NIST SP 800-61 standards to ensure you contain threats without destroying forensic data.

What it does

• Classifies severity using a standardized matrix to determine response speed and escalation paths.
• Executes playbooks for ten specific attack vectors including ransomware, BEC, and cloud compromise.
• Collects evidence via specialized scripts for Linux and Windows that preserve volatile data and generate SHA-256 hashes.
• Builds timelines by merging disparate EDR, proxy, and authentication logs into a single, normalized UTC sequence.
• Generates reports from structured case files, producing executive summaries and technical root cause analyses.

How it works

1. Initial triage starts by applying the severity matrix and stabilizing the environment without powering down hosts.
2. Playbook selection identifies the specific attack type to load the corresponding step-by-step containment and eradication checklist.
3. Evidence gathering runs the triage collectors on affected systems to secure memory, process, and log data.
4. Analysis and reporting merges evidence into a super-timeline and exports a Markdown or HTML incident report.

Frameworks & tools

This skill follows the NIST SP 800-61 incident handling lifecycle. It utilizes Python 3 for timeline merging and report generation, Bash for Linux triage, and PowerShell for Windows live-response collection.

Why this beats prompting it yourself

Generic AI prompts often suggest "rebooting" or "reimaging" too early, which destroys critical memory evidence. This skill embeds specific forensic best practices and structured templates that ensure legal and technical defensibility.

Use cases

• Responding to active ransomware encryption across server clusters.
• Investigating a Business Email Compromise (BEC) involving unauthorized mail rules.
• Performing live-response triage on a suspicious Linux web server.
• Creating a post-mortem report for stakeholders after a data exfiltration event.

Known limitations

Requires elevated privileges (sudo or Administrator) to run collection scripts on target hosts. Output should be written to external or network storage to avoid disk contamination.