Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsSecurity Incident Triage
Professional security incident triage for SOC teams to classify alerts, assess severity, and draft response plans.
$10
security-incident-triage
Example session with this skill installed
Triage the following alert: an endpoint detection platform flagged suspicious PowerShell execution on a finance workstation at 02:14 UTC followed by LSASS memory access attempts. The user was not logged in at the time. Assess severity, classify the incident type, map any TTPs, and provide an initial action plan.
- Read your context and instructions
- Compiled the security-incident-triage
The skill produces a structured triage report classifying the incident as P1 Critical under NIST SP 800-61 category TA0006 (Credential Access), with MITRE ATT&CK technique mappings for T1059.001 (PowerShell) and T1003.001 (LSASS Memory), a severity assessment with evidence basis and confidence level, an escalation recommendation targeting the incident commander, an initial action plan covering evidence preservation, endpoint isolation, and threat intelligence enrichment, and a structured incident ticket summary ready for case management import. All assumptions and validation points requiring confirmation are clearly marked.
Connects securely to your tools. The creator never sees your data.
About this skill
High-Level Security Triage for SOC & DevOps
This skill provides a structured framework for analyzing security alerts, user reports, and threat intelligence matches. It bridges the gap between raw log data and actionable incident response by automating the initial triage process.
What it does
The skill acts as a virtual SOC Tier 1/2 analyst. It ingest evidence—such as process chains, network connections, and file hashes—to produce a severity-assessed incident report. It prioritizes response efforts, recommends escalation paths, and maps activities to the MITRE ATT&CK framework when evidence supports it.
Why use this skill?
- Structured Methodology: Unlike generic AI prompts, this skill follows rigorous defensive security principles, separating confirmed facts from assumptions.
- Tool Agnostic: Works across any EDR, SIEM, or cloud identity platform by requesting specific context when needed.
- Operational Safety: Includes built-in guardrails against providing offensive guidance or recommending destructive containment without authorization.
- Ready for Integration: Produces summaries specifically formatted for incident tickets (Jira, ServiceNow) or executive briefings.
The Result
You receive a comprehensive triage report including a severity rationale, affected scope, evidence summary, and a prioritized initial action plan for your security operations team.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 4 months ago
- Passed all security checks, Safe to install
Needs access to
Nist
Mitre