New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Ise Incident Response

by automateyournetwork in automateyournetwork/netclaw

Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident.

Apache-2.0Auto-check passedDevOps & Cloud

Install Ise Incident Response

skills CLI
$ npx skills add automateyournetwork/netclaw --skill ise-incident-response -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install automateyournetwork/netclaw ise-incident-response --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/automateyournetwork/netclaw.git skills-src && mkdir -p .claude/skills && cp -r skills-src/workspace/skills/ise-incident-response .claude/skills/ise-incident-response && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
ise-incident-response
GitHub stars
676
Token cost
~3.4k tokens
SKILL.md length
934 words
Files
1
Skills in repo
120
Repo updated
First seen
Licence
Apache-2.0

At a glance

Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident.

  • Works in 7 steps: Endpoint Identification → Authentication History Review → Posture and Profile Assessment → …
  • A SOC alert flags a compromised endpoint
  • SKILL.md covers Safety -- Non-Negotiable Rules, When to Use, How to Call the ISE MCP Tools and Incident Response Procedure, plus 4 more sections
  • Calls python3; needs ISE_PASSWORD

What it does

Ise Incident Response is an agent skill from automateyournetwork/netclaw. Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident. Use when a SOC alert flags a compromised endpoint, an unauthorized device is detected on the network, an endpoint is doing port scanning or lateral movement, or you need to quarantine a MAC address in ISE.

Its SKILL.md is about 3.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Security operations, Incident response and Red teaming and adversary simulation. It works with ServiceNow. The repository describes itself as: An AI agent that claws through your network. The licence is Apache-2.0.

When your agent uses it

  • A SOC alert flags a compromised endpoint
  • An unauthorized device is detected on the network
  • An endpoint is doing port scanning
  • Lateral movement

Example prompts

  • “/ise-incident-response”

Requirements

  • Python 3

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Endpoint Identification
  2. Authentication History Review
  3. Posture and Profile Assessment
  4. Risk Assessment and Recommendation
  5. Quarantine Execution (Human-Authorized Only)
  6. Open ServiceNow Security Incident
  7. GAIT Audit Trail

What it can do on your machine

Read from SKILL.md and the folder at commit aa90e7d. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • python3

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • ISE_PASSWORD

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Ise Incident Response loads about 3.4k tokens when it runs. Until then it costs about 98 tokens; SKILL.md has 934 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~98
When it runs · the whole SKILL.md, loaded when a task matches
~3.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from automateyournetwork/netclaw at commit aa90e7d, republished under its Apache-2.0 licence (© automateyournetwork). 934 words, ~3,390 tokens.

Download SKILL.mdSave it as .claude/skills/ise-incident-response/SKILL.md (or your agent's skills folder).
name
ise-incident-response
description
Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident. Use when a SOC alert flags a compromised endpoint, an unauthorized device is detected on the network, an endpoint is doing port scanning or lateral movement, or you need to quarantine a MAC address in ISE.
license
Apache-2.0
user-invocable
true

ISE Incident Response

Safety -- Non-Negotiable Rules

NEVER auto-quarantine an endpoint. Endpoint group changes require explicit human confirmation. The agent MUST present its findings, state its recommendation, and then STOP and WAIT for the human to type an affirmative response before proceeding with any ISE endpoint group modification.

NEVER skip the investigation steps. Even if the human says "just quarantine MAC XX:XX:XX:XX:XX:XX", the agent MUST first collect endpoint data, auth history, and posture state so the quarantine action has full context for the ServiceNow ticket and GAIT audit trail.

NEVER modify ISE authorization policies during incident response. This workflow changes endpoint group membership only. Policy changes require a separate Change Request via servicenow-change-workflow.

When to Use

  • Suspected compromised endpoint (SOC alert, SIEM correlation)
  • Unauthorized device detected on the network
  • Endpoint exhibiting anomalous behavior (port scanning, lateral movement)
  • Failed posture compliance requiring immediate isolation
  • Rogue access point or hub detected on a switchport

How to Call the ISE MCP Tools

All ISE tools are called via mcp-call with the ISE MCP server command:

bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" TOOL_NAME '{"param":"value"}'

ServiceNow tools are called via:

bash
python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" TOOL_NAME '{"param":"value"}'

Incident Response Procedure

Phase 1: Endpoint Identification

Locate the suspect endpoint by MAC address, IP address, or username. Start with the endpoints list and active sessions.

Look up all endpoints:

bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" endpoints '{}'

Check active sessions for the suspect:

bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'

Filter the results for the target MAC/IP/username. Record:

  • MAC address
  • IP address (if assigned)
  • Username (if 802.1X authenticated)
  • Connected switch and port
  • Identity group membership
  • Profile classification
  • Session state (active/inactive)
Phase 2: Authentication History Review

Pull authorization and authentication rules to understand what access the endpoint was granted and why:

bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" network_access_authorization_rules '{}'
bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" network_access_authentication_rules '{}'
bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" network_access_policy_set '{}'

Determine:

  • Which policy set matched the endpoint
  • Which authorization rule granted access
  • What authorization profile was assigned (VLAN, dACL, SGT)
  • Whether posture was evaluated
  • Whether 802.1X or MAB was used
Phase 3: Posture and Profile Assessment

Evaluate the endpoint's posture compliance and profiling accuracy:

bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" profiler_profiles '{}'
bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" identity_groups '{}'

Determine:

  • Is the endpoint posture-compliant, non-compliant, or unknown?
  • What profiler profile matched? What certainty factor?
  • Is the endpoint in the correct identity group?
  • Does the endpoint profile match expected behavior (e.g., a "printer" making HTTP requests to external sites)?
Phase 4: Risk Assessment and Recommendation

Compile findings and present a risk assessment to the human operator:

ENDPOINT INVESTIGATION SUMMARY
===============================
Target: [MAC address]
IP: [IP address]
Username: [username or N/A]
Location: [switch:port]
Profile: [ISE profile] (certainty: N)
Identity Group: [current group]
Auth Method: [802.1X / MAB]
Authorization Rule: [rule name]
Authorization Profile: [profile name — VLAN, dACL, SGT]
Posture Status: [Compliant / Non-Compliant / Unknown / Not Assessed]
Session Duration: [time]

RISK INDICATORS:
  - [List specific concerns, e.g., "Profiled as printer but generating DNS queries to known C2 domains"]
  - [e.g., "MAB-only authentication — no certificate or credential validation"]
  - [e.g., "Non-compliant posture but granted production VLAN access"]

RECOMMENDATION: [QUARANTINE / MONITOR / NO ACTION]
Rationale: [Brief explanation of why this recommendation is being made]
*** HUMAN DECISION POINT ***

STOP HERE. Present the investigation summary above and ask the human operator:

"Based on this investigation, I recommend [QUARANTINE/MONITOR/NO ACTION] for endpoint [MAC]. Do you authorize me to move this endpoint to the quarantine identity group in ISE? Please confirm with YES or NO."

Do NOT proceed to Phase 5 unless the human explicitly responds with an affirmative.

If the human says NO or requests monitoring only, skip to Phase 6 (ServiceNow) and record the decision.

Phase 5: Quarantine Execution (Human-Authorized Only)

This phase executes ONLY after explicit human authorization.

Move the endpoint to the quarantine identity group. The ISE MCP endpoint tools handle endpoint group membership. The specific approach depends on the ISE MCP endpoint update capabilities.

After the group change:

  1. Verify the endpoint group was updated by re-querying:
bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" endpoints '{}'
  1. Verify the active session was affected (CoA should trigger reauth):
bash
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'
  1. Confirm the endpoint is now in the quarantine group and receiving restricted access.
Phase 6: Open ServiceNow Security Incident

Create a Security Incident in ServiceNow documenting the investigation and action taken:

bash
python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" create_incident '{"short_description":"ISE Security Incident: Endpoint [MAC] quarantined","description":"Endpoint Investigation Report\n\nTarget: [MAC]\nIP: [IP]\nUsername: [username]\nLocation: [switch:port]\nProfile: [profile]\nAuth Method: [auth method]\nPosture: [status]\n\nRisk Indicators:\n- [indicator 1]\n- [indicator 2]\n\nAction Taken: Endpoint moved to quarantine group by [human operator] authorization.\nISE Identity Group: Quarantine\nTimestamp: [ISO 8601 timestamp]","category":"Security","impact":"2","urgency":"2","assignment_group":"Network Security"}'

If the human chose NO ACTION or MONITOR, adjust the ticket accordingly:

bash
python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" create_incident '{"short_description":"ISE Security Investigation: Endpoint [MAC] — monitoring","description":"Endpoint Investigation Report\n\nTarget: [MAC]\nIP: [IP]\nUsername: [username]\nLocation: [switch:port]\n\nInvestigation completed. Human operator reviewed findings and chose MONITOR (no quarantine).\nReason: [human-provided reason if any]\n\nMonitoring actions recommended:\n- Continue session logging\n- Set SIEM alert for this MAC\n- Reassess in 24 hours","category":"Security","impact":"3","urgency":"3","assignment_group":"Network Security"}'

Add work notes with the full investigation timeline:

bash
python3 $MCP_CALL "$SERVICENOW_MCP_SCRIPT" add_comment '{"incident_id":"INC0010001","comment":"Investigation timeline:\n1. Endpoint identified via [source: SOC alert / manual report]\n2. ISE data collected: profile, auth history, posture state\n3. Risk assessment: [QUARANTINE/MONITOR/NO ACTION]\n4. Human decision: [AUTHORIZED/DECLINED]\n5. Action executed: [describe]\n6. Verification: [endpoint confirmed in quarantine group / monitoring continues]","is_work_note":true}'
Show full SKILL.md (375 more words)Show less
Phase 7: GAIT Audit Trail

Record the full incident response session in GAIT:

bash
python3 $MCP_CALL "python3 -u $GAIT_MCP_SCRIPT" gait_record_turn '{"user_text":"Example only: replace with the actual authorized request.","assistant_text":"ISE Incident Response completed. Target: [MAC]. Investigation: auth history reviewed, posture assessed, profile verified. Risk: [HIGH/MEDIUM/LOW]. Recommendation: [QUARANTINE/MONITOR]. Human decision: [AUTHORIZED/DECLINED]. Action: [endpoint quarantined / monitoring only]. ServiceNow: INC0010001 created.","artifacts":[]}'

Example: Full Investigation Flow

Scenario: SOC alerts on MAC AA:BB:CC:DD:EE:FF making lateral connections to finance VLAN.

bash
# Step 1: Find the endpoint
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" endpoints '{}'

# Step 2: Check if it has an active session
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'

# Step 3: Review what authorization it received
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" network_access_authorization_rules '{}'

# Step 4: Check its profile and posture
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" profiler_profiles '{}'

# Step 5: Check identity group
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" identity_groups '{}'

# Step 6: Check TrustSec assignment
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" trustsec_sgts '{}'

Present findings to operator. Wait for human decision.

If authorized:

bash
# Verify quarantine took effect
python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" endpoints '{}'

python3 $MCP_CALL "ISE_BASE=$ISE_BASE USERNAME=$ISE_USERNAME PASSWORD=$ISE_PASSWORD python3 -u $ISE_MCP_SCRIPT" active_sessions '{}'

Then open ServiceNow incident and record in GAIT.

Investigation Checklist

Use this checklist to ensure no step is skipped:

  • Endpoint identified (MAC, IP, username, switch:port)
  • Active session state checked
  • Authorization rule and profile determined
  • Authentication method verified (802.1X vs MAB)
  • Posture compliance status confirmed
  • Profiler profile and certainty factor reviewed
  • Identity group membership noted
  • TrustSec SGT assignment checked (if applicable)
  • Risk assessment compiled and presented to human
  • Human decision received (QUARANTINE / MONITOR / NO ACTION)
  • Action executed (if authorized)
  • Post-action verification completed
  • ServiceNow Security Incident created
  • GAIT audit trail recorded

Integration with Other Skills

  • Use ise-posture-audit for the comprehensive policy review that often follows an incident
  • Use pyats-security to verify the network device-side 802.1X and port-security configuration on the affected switchport
  • Use pyats-troubleshoot to trace the endpoint's network path and verify ACL enforcement at each hop
  • Use servicenow-change-workflow if the incident reveals a policy gap that requires an ISE authorization rule change (separate CR required)
  • Use gait-session-tracking to maintain the immutable audit trail across the full incident lifecycle
  • Use markmap-viz to visualize the endpoint's access path (SGT assignment, AuthZ rule, VLAN, dACL)

Failure Behavior

  • If a tool call fails with an authentication or connection error, check that GAIT_MCP_SCRIPT, ISE_BASE, ISE_MCP_SCRIPT, ISE_PASSWORD, ISE_USERNAME, SERVICENOW_MCP_SCRIPT are set and valid before assuming a data or device problem.
  • On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
  • For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.

Audit examples are illustrative. Replace request, outcomes, identifiers and counts with observed session evidence; do not record these example results as facts. Inspect MCP isError, returned ok, and the recorded turn with gait_show when validating a new client/schema. Follow gait-session-tracking for branch checkout.

© automateyournetwork, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in workspace/skills/ise-incident-response of automateyournetwork/netclaw.

Open the folder on GitHubat commit aa90e7d

Compare with similar skills

Ise Incident Response next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Ise Incident Response compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Ise Incident Response this skillautomateyournetwork/netclaw676—~3.4kAutomated safety check: PassApache-2.0
Azure Kusto Irqlmicrosoft/GitHub-Copilot-for-Azure255—~2.6kAutomated safety check: PassMIT
Incident Response NetworkLeoYeAI/openclaw-master-skills2.2k—~5kAutomated safety check: PassApache-2.0
Detecting Pass The Hash Attacksmukul975/Anthropic-Cybersecurity-Skills34k—~904Automated safety check: PassApache-2.0
Detecting Privilege Escalation Attemptsmukul975/Anthropic-Cybersecurity-Skills34k—~922Automated safety check: PassApache-2.0
Implementing Soar Playbook With Palo Alto Xsoarmukul975/Anthropic-Cybersecurity-Skills34k—~2.4kAutomated safety check: PassApache-2.0

Similar skills

  • Azure Kusto Irql

    microsoft/GitHub-Copilot-for-Azure

    Official

    Compose IRQL (Incident Response Query Language) queries for Kusto cybersecurity investigations.

    255 GitHub stars~2.6k tokensUpdated yesterday
    DevOps & CloudAuto-check passed

  • Incident Response Network

    LeoYeAI/openclaw-master-skills

    Network forensics evidence collection and analysis during security incidents.

    2.2k GitHub stars~5k tokensUpdated 2 mo ago
    SecurityAuto-check passed

  • Detecting Pass The Hash Attacks

    mukul975/Anthropic-Cybersecurity-Skills

    Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping…

    34k GitHub stars~904 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Detecting Privilege Escalation Attempts

    mukul975/Anthropic-Cybersecurity-Skills

    Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse.

    34k GitHub stars~922 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Implementing Soar Playbook With Palo Alto Xsoar

    mukul975/Anthropic-Cybersecurity-Skills

    Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise…

    34k GitHub stars~2.4k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

  • Conducting Cloud Incident Response

    mukul975/Anthropic-Cybersecurity-Skills

    Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic…

    34k GitHub stars~3k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

More from automateyournetwork/netclaw

All 120 skills in this repo

  • EVE-NG Lab Topology Design

    automateyournetwork/netclaw

    Entry point for designing EVE-NG network labs: classifies the request, gathers missing requirements, proposes options and validates the resulting topology.

    677 GitHub stars~612 tokensUpdated today
    Auto-check passed

  • ACI Policy Change Deployment

    automateyournetwork/netclaw

    Deploys Cisco ACI policy changes only behind an approved ServiceNow Change Request, capturing pre and post-change fault baselines and rolling back automatically on a fault delta.

    677 GitHub stars~4.2k tokensUpdated today
    Auto-check passed

  • Cisco ACI Fabric Health Audit

    automateyournetwork/netclaw

    Runs a phased health audit of a Cisco ACI fabric through MCP tools: node status, links, tenant and policy review, faults and endpoint learning.

    677 GitHub stars~2.9k tokensUpdated today
    Auto-check passed

  • Anta Validation

    automateyournetwork/netclaw

    Validate Arista EOS network state against ANTA's pre-built 208-test catalogue, with structured pass/fail verdicts.

    677 GitHub stars~1.2k tokensUpdated today
    Auto-check passed

  • Arista Cvp

    automateyournetwork/netclaw

    Arista CloudVision Portal (CVP) automation via REST API — device inventory, events, connectivity monitoring, tag management (4 tools).

    677 GitHub stars~2.2k tokensUpdated today
    Auto-check: notes

  • AWS Cloud Monitoring

    automateyournetwork/netclaw

    AWS CloudWatch monitoring — metrics, alarms, log queries, VPC flow log analysis, network performance.

    677 GitHub stars~1k tokensUpdated today
    Auto-check passed

Works with

Categories

Questions about Ise Incident Response

What does Ise Incident Response do?

Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident. Ise Incident Response is an agent skill from automateyournetwork/netclaw. Rapid ISE endpoint investigation and quarantine workflow - endpoint lookup, auth history, posture review, human-authorized quarantine, ServiceNow Security Incident.

When should I use Ise Incident Response?

Ise Incident Response fits situations like: A SOC alert flags a compromised endpoint; an unauthorized device is detected on the network; an endpoint is doing port scanning; lateral movement.

How do I install Ise Incident Response in Claude Code?

Run `npx skills add automateyournetwork/netclaw --skill ise-incident-response -a claude-code`. Or copy the skill folder (workspace/skills/ise-incident-response in automateyournetwork/netclaw) into .claude/skills/ise-incident-response in your project. Claude Code loads it when a task matches its description.

How do I install Ise Incident Response in Codex?

Run `npx skills add automateyournetwork/netclaw --skill ise-incident-response -a codex`. Or copy the skill folder (workspace/skills/ise-incident-response in automateyournetwork/netclaw) into .agents/skills/ise-incident-response in your project. Codex loads it when a task matches its description.

Can I use Ise Incident Response in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add automateyournetwork/netclaw --skill ise-incident-response -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/ise-incident-response, .gemini/skills/ise-incident-response, .github/skills/ise-incident-response and .opencode/skills/ise-incident-response in your project.

What does Ise Incident Response need to run?

Going by SKILL.md and its folder, Ise Incident Response needs the command-line tools its instructions call (python3) and credentials named ISE_PASSWORD. Our summary lists: Python 3.

Does Ise Incident Response access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Ise Incident Response safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Ise Incident Response use?

Ise Incident Response is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Ise Incident Response use?

About 3.4k tokens (SKILL.md is roughly 14k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Ise Incident Response?

Skills that share tags, products or a category with Ise Incident Response: Azure Kusto Irql (microsoft/GitHub-Copilot-for-Azure, 255 stars), Incident Response Network (LeoYeAI/openclaw-master-skills, 2.2k stars), Detecting Pass The Hash Attacks (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Detecting Privilege Escalation Attempts (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Ise Incident Response?

automateyournetwork (a GitHub user) maintains it in automateyournetwork/netclaw, which has 676 GitHub stars. The repository holds 120 skills in this directory. The repository was last updated on October 9, 2026.

Source: automateyournetwork/netclaw on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.