Ransomware Response Coordinator

What it does

The Ransomware Response Coordinator is a specialized incident response (IR) framework designed to guide cybersecurity professionals through the critical stages of a ransomware crisis. It orchestrates the transition from initial detection to forensic preservation, containment, and recovery planning by synthesizing evidence like ransom notes, logs, and asset context.

Why use this skill

Unlike generic AI prompts that provide surface-level advice, this skill enforces strict defensive protocols and enterprise-grade IR methodologies. It ensures that security teams don't miss critical steps like checking backup immutability or preserving forensic evidence before containment. It handles the "fog of war" by separating confirmed facts from assumptions, helping leads provide clear updates to legal, insurance, and executive stakeholders.

Supported Workflows

• Triage: Validating indicators of compromise (IOCs) and mass encryption events.
• Containment: Prioritizing lateral movement reduction and identity isolation.
• Recovery: Developing decision matrices for clean restores vs. system rebuilds.
• Reporting: Generating executive summaries, forensic trackers, and post-incident hardening plans.

The skill is product-agnostic and adapts to your specific stack, whether you use Splunk, CrowdStrike, Veeam, or SentinelOne.