Respond fast, contain blast radius, and learn permanently.
Quick Start (incident workflow)
- Triage: what’s impacted, is it ongoing, and what data is at risk?
- Contain: disable credentials, block IOCs, isolate systems.
- Eradicate: patch root cause, rotate secrets, remove persistence.
- Recover: restore service safely; verify integrity.
- Learn: write a postmortem and ship preventative controls.
Optional tool: summarize a log file
python ~/.codex/skills/senior-secops/scripts/log_triage.py /path/to/log.txt --out /tmp/log_report.json
References
- Incident worksheet:
references/incident-worksheet.md