incident-response

Topics in the source

• Incident Response
• Table of Contents
• Overview
• What This Skill Does
• Distinction from Other Security Skills
• Prerequisites
• Incident Triage Tool
• Input Event Schema

Incident response skill for the full lifecycle from initial triage through forensic collection, severity declaration, and escalation routing. This is NOT threat hunting (see threat-detection) or post-incident compliance mapping (see governance/compliance-mapping) — this is about classifying, triaging, and managing declared security incidents. -- Overview Incident Triage Tool Incident Classification Severity Framework False Positive Filtering Forensic Evidence Collection Escalation Paths Regulatory Notification Obligations Workflows Anti-Patterns Cross-References -- This skill provides the methodology and tooling for incident triage and response — classifying security events into typed incidents, scoring severity, filtering false positives, determining escalation paths, and initiating forensic evidence collection under chain-of-custody controls. | Skill | Focus | Approach | |-------|-------|----------| | incident-response (this) | Active incidents | Reactive — classify, escalate, collect evidence | | threat-detection | Pre-incident hunting | Proactive — find threats before alerts fire | | cloud-security | Cloud posture assessment | Preventive — IAM, S3, network misconfiguration | |

This is an excerpt. Refer to the complete source and its current requirements.