New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Triaging Security Incident

by mukul975 in mukul975/Anthropic-Cybersecurity-Skills

Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate…

Apache-2.0Auto-check passedSecurity

Install Triaging Security Incident

skills CLI
$ npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install mukul975/Anthropic-Cybersecurity-Skills triaging-security-incident --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/triaging-security-incident .claude/skills/triaging-security-incident && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
triaging-security-incident
GitHub stars
34k
Token cost
~2.3k tokens
SKILL.md length
776 words
Files
4 (incl. scripts, references)
Skills in repo
644
Repo updated
First seen
Licence
Apache-2.0

At a glance

Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate…

  • Works in 6 steps: Collect Initial Alert Data → Classify the Incident Type → Assign Severity Using Impact Matrix → …
  • A SIEM/EDR alert needs human classification
  • SKILL.md covers When to Use, Prerequisites, Workflow and Key Concepts, plus 3 more sections
  • Runs Python scripts from its folder

What it does

Triaging Security Incident is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.

Its SKILL.md is about 2.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 5 other files, including scripts and reference files (for example `references/api-reference.md` and `scripts/agent.py`).

It sits in Security, covering Security operations. The repository describes itself as: 817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF & MITRE F3 (Fight Fraud) · agentskills.io…. The licence is Apache-2.0.

When your agent uses it

  • A SIEM/EDR alert needs human classification
  • Concurrent alerts must be prioritized
  • Threat-intel IOC match requires initial incident categorization

Example prompts

  • “Use the triaging-security-incident skill to perform initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks…”
  • “/triaging-security-incident”

Requirements

  • Python 3

Workflow steps

6 steps, taken from the step headings in SKILL.md.

  1. Collect Initial Alert Data
  2. Classify the Incident Type
  3. Assign Severity Using Impact Matrix
  4. Perform Initial Enrichment
  5. Document and Escalate
  6. Initiate Containment Hold

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 1 file in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Triaging Security Incident loads about 2.3k tokens when it runs, and up to ~2.9k if it reads all its reference files. Until then it costs about 104 tokens; SKILL.md has 776 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~104
When it runs · the whole SKILL.md, loaded when a task matches
~2.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~2.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 776 words, ~2,338 tokens.

Download SKILL.mdSave it as .claude/skills/triaging-security-incident/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.
name
triaging-security-incident
description
Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.
domain
cybersecurity
subdomain
incident-response
tags
incident-triage, NIST-800-61, SANS-PICERL, severity-classification, SOC-operations
mitre_attack
T1486, T1490, T1070, T1078
version
1.0.0
author
mahipal
license
Apache-2.0
d3fend_techniques
Executable Denylisting, Execution Isolation, File Metadata Consistency Validation, Content Format Conversion, File Content Analysis
nist_csf
RS.MA-01, RS.MA-02, RS.AN-03, RC.RP-01

Triaging Security Incidents

When to Use

  • A SIEM or EDR alert fires and requires human classification before escalation
  • Multiple concurrent alerts arrive and the SOC must prioritize response order
  • An end user reports suspicious activity and the incident needs initial categorization
  • A threat intelligence feed matches an IOC observed in the environment

Do not use for routine vulnerability scanning results or compliance audit findings that do not represent active security incidents.

Prerequisites

  • Access to SIEM platform (Splunk, Elastic, Microsoft Sentinel) with current alert data
  • Incident classification taxonomy aligned to NIST SP 800-61r3 categories
  • Predefined severity matrix mapping asset criticality to threat type
  • Contact roster for escalation paths (Tier 1 through Tier 3 and CIRT)
  • Asset inventory with business criticality ratings

Workflow

Step 1: Collect Initial Alert Data

Gather all available context from the triggering alert before making classification decisions:

  • Alert source: Which detection system generated the alert (EDR, SIEM, IDS/IPS, firewall, user report)
  • Timestamp: When the event occurred and when it was detected (dwell time gap)
  • Affected assets: Hostnames, IP addresses, user accounts involved
  • Alert fidelity: Historical true-positive rate for this detection rule
  • Raw evidence: Log entries, packet captures, process execution chains
Example SIEM alert context:
Source:       CrowdStrike Falcon
Detection:    Suspicious PowerShell Execution (T1059.001)
Host:         WORKSTATION-FIN-042
User:         jsmith@corp.example.com
Timestamp:    2025-11-15T14:23:17Z
Severity:     High (detection rule confidence: 92%)
Process:      powershell.exe -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA...
Parent:       outlook.exe (PID 4812)
Step 2: Classify the Incident Type

Map the alert to a standard incident category per NIST SP 800-61r3:

CategoryExamples
Unauthorized AccessCompromised credentials, privilege escalation, IDOR
Denial of ServiceVolumetric DDoS, application-layer flood, resource exhaustion
Malicious CodeMalware execution, ransomware detonation, cryptominer
Improper UsagePolicy violation, insider data exfiltration, shadow IT
ReconnaissancePort scanning, directory enumeration, credential spraying
Web Application AttackSQL injection, XSS, SSRF exploitation
Step 3: Assign Severity Using Impact Matrix

Calculate severity by combining asset criticality with threat severity:

Severity = f(Asset Criticality, Threat Type, Data Sensitivity, Lateral Movement Potential)

Critical (P1): Crown jewel systems compromised, active data exfiltration, ransomware spreading
High (P2):     Production system compromise, confirmed malware execution, privileged account takeover
Medium (P3):   Non-production compromise, unsuccessful exploitation attempt, single endpoint malware
Low (P4):      Reconnaissance activity, policy violation, benign true positive

Response SLA targets:

  • P1: Acknowledge within 15 minutes, containment within 1 hour
  • P2: Acknowledge within 30 minutes, containment within 4 hours
  • P3: Acknowledge within 2 hours, investigation within 24 hours
  • P4: Acknowledge within 8 hours, investigation within 72 hours
Step 4: Perform Initial Enrichment

Before escalation, enrich the alert with contextual data:

  • Threat intelligence: Check IOCs (IP, hash, domain) against TI platforms (VirusTotal, OTX, MISP)
  • Asset context: Query CMDB for asset owner, business function, data classification
  • User context: Check identity provider for recent authentication anomalies, MFA status
  • Historical correlation: Search for related alerts on the same host/user in the past 30 days
  • Network context: Verify if source/destination IPs are internal, known partners, or external threat actors
Step 5: Document and Escalate

Create a structured triage record and route to the appropriate response tier:

Incident Triage Record
━━━━━━━━━━━━━━━━━━━━━
Ticket ID:       INC-2025-1547
Triage Analyst:  [analyst name]
Triage Time:     2025-11-15T14:35:00Z (12 min from alert)
Classification:  Malicious Code - Macro-based initial access
Severity:        P2 - High
Affected Assets: WORKSTATION-FIN-042 (Finance dept, handles PII)
Affected Users:  jsmith@corp.example.com
IOCs Identified: powershell.exe spawned by outlook.exe, encoded command
TI Matches:      Base64 payload matches known Qakbot loader pattern
Escalation:      Tier 2 - Malware IR team
Recommended:     Isolate endpoint, preserve memory dump, block sender domain
Step 6: Initiate Containment Hold

If severity is P1 or P2, initiate immediate containment actions while awaiting full investigation:

  • Network-isolate the affected endpoint via EDR (CrowdStrike contain, Defender isolate)
  • Disable compromised user accounts in Active Directory or identity provider
  • Block identified malicious IPs/domains at firewall and DNS sinkhole
  • Preserve volatile evidence (memory dump) before any remediation
Show full SKILL.md (312 more words)Show less

Key Concepts

TermDefinition
TriageRapid assessment process to classify and prioritize security incidents based on severity and business impact
PICERLSANS incident response framework: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned
Dwell TimeDuration between initial compromise and detection; average is 10 days per Mandiant M-Trends 2025
True Positive RatePercentage of alerts from a detection rule that represent genuine security incidents
Crown Jewel AssetsSystems and data critical to business operations whose compromise would cause severe organizational impact
Alert FatigueDegraded analyst performance caused by high volumes of low-fidelity or false-positive alerts
Mean Time to Acknowledge (MTTA)Average time from alert generation to analyst acknowledgment; key SOC performance metric

Tools & Systems

  • Splunk Enterprise Security: SIEM platform for alert aggregation, correlation, and triage workflow management
  • CrowdStrike Falcon: EDR platform providing endpoint telemetry, detection, and one-click host containment
  • TheHive: Open-source incident response platform for case management, task tracking, and team collaboration
  • MISP: Threat intelligence sharing platform for IOC enrichment during triage
  • Cortex XSOAR: SOAR platform for automating enrichment playbooks and triage decision trees

Common Scenarios

Scenario: Encoded PowerShell from Email Client

Context: SOC analyst receives a P2 alert showing powershell.exe with a Base64-encoded command spawned as a child process of outlook.exe on a finance department workstation.

Approach:

  1. Decode the Base64 payload to determine the command intent
  2. Check the parent process chain for anomalies (Outlook spawning PowerShell is abnormal)
  3. Query VirusTotal for the decoded payload hash
  4. Correlate with email gateway logs to identify the triggering email and sender
  5. Check if other recipients in the organization received the same email
  6. Isolate the endpoint and escalate to Tier 2 with full triage context

Pitfalls:

  • Dismissing encoded PowerShell as a false positive without decoding the payload
  • Failing to check for lateral spread to other recipients of the same phishing email
  • Remediating the endpoint before capturing volatile memory evidence

Output Format

INCIDENT TRIAGE REPORT
======================
Ticket:          INC-[YYYY]-[NNNN]
Date/Time:       [ISO 8601 timestamp]
Triage Analyst:  [Name]
Time to Triage:  [minutes from alert to classification]

CLASSIFICATION
Type:            [NIST category]
Severity:        [P1-P4] - [Critical/High/Medium/Low]
Confidence:      [High/Medium/Low]
MITRE ATT&CK:   [Technique ID and name]

AFFECTED SCOPE
Assets:          [hostname(s), IP(s)]
Users:           [account(s)]
Data at Risk:    [classification level]
Business Unit:   [department]

EVIDENCE SUMMARY
[Bullet list of key observations]

ENRICHMENT RESULTS
TI Matches:      [Yes/No - details]
Historical:      [Related prior incidents]
Asset Criticality: [rating]

RECOMMENDED ACTIONS
1. [Immediate action]
2. [Investigation step]
3. [Escalation target]

ESCALATION
Routed To:       [Team/Individual]
SLA Target:      [Containment deadline]

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/triaging-security-incident of mukul975/Anthropic-Cybersecurity-Skills.

  • SKILL.md
  • LICENSE
  • references/api-reference.md
  • scripts/agent.py

Open the folder on GitHubat commit 54a7988

Compare with similar skills

Triaging Security Incident next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Triaging Security Incident compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Triaging Security Incident this skillmukul975/Anthropic-Cybersecurity-Skills34k—~2.3kAutomated safety check: PassApache-2.0
Security Alert Triageelastic/agent-skills5921 repos~3.5kAutomated safety check: NotesApache-2.0
Kubernetes Network Security Auditkubeshark/kubeshark12k—~7.3kAutomated safety check: NotesApache-2.0
Security Detection Rule Managementelastic/agent-skills5921 repos~3.9kAutomated safety check: NotesApache-2.0
Chaitin CLIchaitin/chaitin-cli115—~15kAutomated safety check: NotesGPL-3.0
GatesNebulock-Inc/agentic-threat-hunting-framework388—~12kAutomated safety check: PassMIT

Similar skills

  • Security Alert Triage

    elastic/agent-skills

    Official

    Triage Elastic Security alerts — gather context, classify threats, create cases, and acknowledge.

    592 GitHub starsUsed in 1 repo~3.5k tokens
    SecurityAuto-check: notes

  • Kubernetes Network Security Audit

    kubeshark/kubeshark

    Hunts for compromised workloads and malicious traffic in a Kubernetes cluster by sweeping network data through Kubeshark MCP, mapped to MITRE ATT&CK.

    12k GitHub stars~7.3k tokensUpdated today
    SecurityAuto-check: notes

  • Security Detection Rule Management

    elastic/agent-skills

    Official

    Create, tune, and manage Elastic Security detection rules (SIEM and Endpoint).

    592 GitHub starsUsed in 1 repo~3.9k tokens
    SecurityAuto-check: notes

  • Chaitin CLI

    chaitin/chaitin-cli

    A skill your agent uses when running chaitin-cli commands to manage Chaitin security products: SafeLine WAF (site management, IP blocking, ACL, policy rules, attack logs), X-Ray vulnerability…

    115 GitHub stars~15k tokensUpdated 11 days ago
    SecurityAuto-check: notes

  • Gates

    Nebulock-Inc/agentic-threat-hunting-framework

    GATES method validation for hunt-derived detections. An agent skill from Nebulock-Inc/agentic-threat-hunting-framework.

    388 GitHub stars~12k tokensUpdated yesterday
    SecurityAuto-check passed

  • Elasticsearch Audit

    aspectrr/deer

    Enable, configure, and query Elasticsearch security audit logs.

    405 GitHub stars~1.7k tokensUpdated 5 mo ago
    SecurityAuto-check passed

More from mukul975/Anthropic-Cybersecurity-Skills

All 644 skills in this repo

  • Campaign Attribution Evidence Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Weighs infrastructure, TTP, malware code and timing evidence with the Diamond Model and competing hypotheses to reach a confidence-rated attribution.

    34k GitHub stars~2.3k tokensUpdated 1 mo ago
    Auto-check passed

  • Go Malware Analysis in Ghidra

    mukul975/Anthropic-Cybersecurity-Skills

    Walks through reverse engineering Go-compiled malware in Ghidra: parsing buildinfo and pclntab, recovering stripped function names and extracting dependencies.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • LNK and Jump List Forensics

    mukul975/Anthropic-Cybersecurity-Skills

    Guides forensic analysis of Windows LNK shortcut files and Jump Lists with LECmd, JLECmd and manual parsing to show file access and program execution.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Auto-check passed

  • Malware Persistence Analysis with Autoruns

    mukul975/Anthropic-Cybersecurity-Skills

    Hunts Windows malware persistence with Sysinternals Autoruns, covering run keys, services, scheduled tasks and drivers, with baseline comparison.

    34k GitHub stars~1.2k tokensUpdated 1 mo ago
    Auto-check passed

  • NTFS MFT Deleted File Recovery

    mukul975/Anthropic-Cybersecurity-Skills

    Guides a Windows forensic examination of the NTFS Master File Table to recover deleted-file evidence, build timelines and spot timestomping.

    34k GitHub stars~2.7k tokensUpdated 1 mo ago
    Auto-check passed

  • Network Covert Channel Analysis

    mukul975/Anthropic-Cybersecurity-Skills

    Detects DNS tunneling, ICMP exfiltration and HTTP-based covert channels in packet captures and DNS logs when hunting for hidden command-and-control traffic.

    34k GitHub stars~2k tokensUpdated 1 mo ago
    Auto-check passed

Categories

Questions about Triaging Security Incident

What does Triaging Security Incident do?

Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate…. Triaging Security Incident is an agent skill from mukul975/Anthropic-Cybersecurity-Skills. Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team.

When should I use Triaging Security Incident?

Triaging Security Incident fits situations like: A SIEM/EDR alert needs human classification; concurrent alerts must be prioritized; threat-intel IOC match requires initial incident categorization.

How do I install Triaging Security Incident in Claude Code?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident -a claude-code`. Or copy the skill folder (skills/triaging-security-incident in mukul975/Anthropic-Cybersecurity-Skills) into .claude/skills/triaging-security-incident in your project. Claude Code loads it when a task matches its description.

How do I install Triaging Security Incident in Codex?

Run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident -a codex`. Or copy the skill folder (skills/triaging-security-incident in mukul975/Anthropic-Cybersecurity-Skills) into .agents/skills/triaging-security-incident in your project. Codex loads it when a task matches its description.

Can I use Triaging Security Incident in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/triaging-security-incident, .gemini/skills/triaging-security-incident, .github/skills/triaging-security-incident and .opencode/skills/triaging-security-incident in your project.

What does Triaging Security Incident need to run?

Going by SKILL.md and its folder, Triaging Security Incident needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Triaging Security Incident access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Triaging Security Incident safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Triaging Security Incident use?

Triaging Security Incident is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Triaging Security Incident use?

About 2.3k tokens (SKILL.md is roughly 9.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 594 tokens, read only when the agent opens those files.

What are the alternatives to Triaging Security Incident?

Skills that share tags, products or a category with Triaging Security Incident: Security Alert Triage (elastic/agent-skills, 592 stars), Kubernetes Network Security Audit (kubeshark/kubeshark, 12k stars), Security Detection Rule Management (elastic/agent-skills, 592 stars) and Chaitin CLI (chaitin/chaitin-cli, 115 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Triaging Security Incident?

mukul975 (a GitHub user) maintains it in mukul975/Anthropic-Cybersecurity-Skills, which has 34,116 GitHub stars. The repository holds 644 skills in this directory. The repository was last updated on August 31, 2026.

Source: mukul975/Anthropic-Cybersecurity-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.