SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsincident-responder

incident-responder

Security & auditing

View repository

Updated 10-16 04:57

About this skill

Incident Responder (CSIRT)

When to Use

  • Declare and classify a security incident (scope, severity, data/asset impact)
  • Reconstruct timelines from logs, EDR, cloud audit, identity, and application evidence
  • Preserve forensic artifacts with chain of custody and legal hold awareness
  • Coordinate containment, eradication, and recovery with engineering, cloud, and identity teams
  • Draft stakeholder updates (internal, executive, customer, partner) on a cadence
  • Prepare regulatory notification fact packs for legal/compliance (timelines, data categories, counts)
  • Facilitate post-incident review, lessons learned, and tracked remediation

When NOT to Use

  • Triage and close routine SOC alerts without declared incident → soc-analyst
  • Proactive hypothesis-driven hunts and detection backlog from hunts → threat-hunter
  • Design SEV matrices, on-call rotations, paging, or status-page programs → incident-management-engineer
  • Define enterprise security strategy, policies, or GRC roadmaps → cybersecurity
  • Implement SIEM/EDR connectors, IAM, or guardrails → information-security-engineer
  • Harden cloud accounts or remediate CSPM findings (non-incident) → cloud-security-engineer
  • Authorized penetration testing → penetration-tester
  • Red team / adversary simulation campaign planning → red-team-specialist
  • LLM/agent adversarial testing → ai-redteam
  • Build audit evidence pipelines or control mapping → compliance-engineer
  • Add CI/CD security gates or SBOM workflows → devsecops
  • Lead reliability/SLO mitigation for availability outages → site-reliability-engineer
  • Deep disk/memory artifact analysis, expert witness prep outlines → digital-forensics-analyst
  • Disassembly, decompilation, patch diff, or dedicated malware RE lab work → reverse-engineer

Related skills

Need Skill
SOC alert triage, initial investigation, escalation to CSIRT soc-analyst
Proactive threat hunts, hunt reports, detection feedback before/during IR threat-hunter
Incident program, SEV definitions, on-call, paging, postmortem process incident-management-engineer
Security strategy, IR policy, board narratives cybersecurity
SIEM/EDR/IdP implementation and tooling information-security-engineer
Cloud forensics logs, account isolation, KMS cloud-security-engineer
Pentest validation of fixes penetration-tester
Red team / purple team exercises red-team-specialist
LLM/agent incident reproduction and safety retest ai-redteam
Breach notification legal thresholds and audit evidence compliance-engineer
Pipeline compromise, secrets in CI, artifact integrity devsecops
Customer-facing crisis messaging approval communication-lead
Availability outage and SLO impact site-reliability-engineer
BCP/DRP, RTO/RPO, ransomware recovery sequencing, restore tests bcm-disaster-recovery-specialist
Forensic acquisition, super-timelines, investigation reports for counsel digital-forensics-analyst
Binary/protocol RE, patch analysis, defensive malware deep dive reverse-engineer
Operational intel, campaign context, IOC packages during IR cti-analyst

Core Workflows

1. Intake and declaration

  1. Confirm trigger source (SOC escalation, employee report, vendor, law enforcement, customer)
  2. Assign incident ID; open record and comms channel
  3. Classify type (account compromise, malware, data breach, ransomware, supply chain, etc.)
  4. Set severity from impact and urgency; document rationale
  5. Notify incident commander, legal, and comms per severity matrix

See references/incident_declaration_and_severity.md.

2. Scope and timeline

  1. Identify affected users, systems, accounts, regions, and data classes
  2. Establish first known compromise and detection timestamps (UTC)
  3. Build parallel timeline: attacker actions, defender actions, business events
  4. List evidence sources still available; flag gaps and retention risks
  5. Update scope statement when new facts emerge (version each change)

See references/timeline_and_evidence_handling.md.

3. Containment → eradication → recovery

  1. Contain to stop spread (isolate hosts, disable accounts, block IOCs, revoke tokens)
  2. Eradicate root cause (remove malware, close backdoors, patch vulns, rotate secrets)
  3. Recover with validation (rebuild from gold image, restore from clean backup, monitor for recurrence)
  4. Time-box destructive actions; get approvers for customer-impacting steps
  5. Hand off long-term hardening to owning engineering/security skills

See references/containment_eradication_recovery.md.

4. Stakeholder and regulatory communications

  1. Set update cadence by severity (e.g., 30–60 min for SEV1 security)
  2. Separate facts from hypotheses in every update
  3. Route external/customer/regulatory language through legal and comms
  4. Prepare notification worksheets (what, when, who affected, measures taken)—legal decides if/when to notify

See references/stakeholder_and_regulatory_comms.md.

5. Post-incident review

  1. Close incident only when containment verified and monitoring in place
  2. Run blameless review within agreed SLA (e.g., 5 business days for major incidents)
  3. Capture root cause classes, detection gaps, and prioritized actions with owners/dates
  4. Feed lessons to detection (soc-analyst), controls (information-security-engineer), and program (incident-management-engineer)

See references/post_incident_review.md.

When to load references

  • Role boundaries and handoffs → references/incident_responder_scope.md
  • Declaration and severity → references/incident_declaration_and_severity.md
  • Timeline and evidence → references/timeline_and_evidence_handling.md
  • Contain / eradicate / recover → references/containment_eradication_recovery.md
  • Comms and regulatory prep → references/stakeholder_and_regulatory_comms.md
  • Post-incident review → references/post_incident_review.md

Outputs

  • Incident record — ID, severity, scope, status, owners, key timestamps
  • Timeline — UTC table of events with evidence pointers
  • Evidence log — artifact, collector, hash, storage location, custody notes
  • Action tracker — containment/eradication tasks with approvers
  • Comms drafts — internal, executive, customer (facts-only sections)
  • Regulatory prep pack — fact summary for legal (not legal advice)
  • Post-incident review — findings, actions, detection/control improvements