Best incident response skills, page 2

Expert SRE incident responder specializing in rapid problem resolution.

Dokhacgiakhoa/Agent-Skills-4-Vibe-Coding-CLI

Monitor AI agent health, detect anomalies, set up alerting, and maintain observability dashboards for production multi-agent systems.

cosmicstack-labs/mercury-agent-skills

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

sickn33/agentic-awesome-skills

Investigate sudden drops in organic traffic or rankings and run a structured forensic SEO incident response with triage, root-cause analysis and recovery plan.

sickn33/agentic-awesome-skills

SQL-powered forensic investigation and system interrogation using osquery to query operating systems as relational databases.

AgentSecOps/SecOpsAgentKit

Endpoint visibility, digital forensics, and incident response using Velociraptor Query Language (VQL) for evidence collection and threat hunting at scale.

AgentSecOps/SecOpsAgentKit

Build automated AWS GuardDuty finding response pipelines using EventBridge and Lambda to trigger real-time incident response, automatically quarantine compromised resources, and route security…

mukul975/Anthropic-Cybersecurity-Skills

Detect Pass-the-Hash (T1550.002) attacks by analyzing NTLM authentication patterns, flagging Type 3 logons using NTLM where Kerberos would be expected, and correlating with credential-dumping…

mukul975/Anthropic-Cybersecurity-Skills

Detect privilege escalation attempts across Windows and Linux, including access token manipulation, UAC bypass, unquoted service path abuse, kernel exploits, and sudo/doas abuse.

mukul975/Anthropic-Cybersecurity-Skills

Extracts embedded configuration from Agent Tesla RAT samples, including SMTP/FTP/Telegram exfiltration credentials, keylogger settings, and C2 endpoints, via .NET decompilation and memory analysis.

mukul975/Anthropic-Cybersecurity-Skills

Hunt for data exfiltration by analyzing Zeek and Suricata network telemetry for unusual data flows, DNS tunneling via large/frequent TXT queries, uploads to personal cloud storage, and…

mukul975/Anthropic-Cybersecurity-Skills

Systematically hunts for adversary persistence mechanisms across Windows endpoints, covering registry Run/RunOnce keys, services, startup folders, scheduled tasks, and WMI event subscriptions.

mukul975/Anthropic-Cybersecurity-Skills

Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events (e.g.

mukul975/Anthropic-Cybersecurity-Skills

Runs a hypothesis-driven threat hunt for web shell deployment (T1505.003) on internet-facing servers by analyzing file creation in web directories, suspicious child-process spawning from web server…

mukul975/Anthropic-Cybersecurity-Skills

Deploys Breach and Attack Simulation (BAS) platforms such as SafeBreach, AttackIQ, Picus, Cymulate, Pentera, or SCYTHE to continuously validate endpoint, network, email-gateway, SIEM, and…

mukul975/Anthropic-Cybersecurity-Skills

Build automated incident response playbooks in Cortex XSOAR (Demisto) using its YAML playbook structure, integration commands, and task types to orchestrate phishing, malware, account-compromise…

mukul975/Anthropic-Cybersecurity-Skills

Plans and facilitates tabletop exercises simulating ransomware incidents, using realistic scenarios based on threat actors like LockBit and ALPHV/BlackCat with injects covering double extortion and…

mukul975/Anthropic-Cybersecurity-Skills

Manage active production incidents through detection, triage, mitigation, communication, and resolution with structured roles and decision-making.

rampstackco/claude-skills

Comprehensive incident response framework from detection through resolution and post-incident review.

alirezarezvani/claude-skills

Set up alerting rules, configure on-call rotations, and manage incident response workflows.

sickn33/agentic-awesome-skills

Authorized digital forensics: memory dumps, disk timelines, PCAP investigation, artifact triage, and incident-response evidence preservation.

sickn33/agentic-awesome-skills

Handle security incidents with IR playbooks and procedures. An agent skill from sickn33/agentic-awesome-skills.

sickn33/agentic-awesome-skills

Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition.

mukul975/Anthropic-Cybersecurity-Skills

Examine Linux system artifacts (auth logs, cron/systemd persistence, shell history, SSH keys, and system configuration) to uncover evidence of compromise, detect rootkits or backdoors, and…

mukul975/Anthropic-Cybersecurity-Skills

Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility 3 framework.

mukul975/Anthropic-Cybersecurity-Skills

Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the…

mukul975/Anthropic-Cybersecurity-Skills

Parse Windows Prefetch (.pf) files with the windowsprefetch Python library to reconstruct application execution history, run counts, and accessed file/volume lists.

mukul975/Anthropic-Cybersecurity-Skills

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems…

mukul975/Anthropic-Cybersecurity-Skills

Designs and documents structured incident response playbooks with step-by-step procedures per incident type, decision trees, escalation criteria, RACI matrices, and SOAR platform integration…

mukul975/Anthropic-Cybersecurity-Skills

Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework, covering preparation, detection, containment, eradication…

mukul975/Anthropic-Cybersecurity-Skills

Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and…

mukul975/Anthropic-Cybersecurity-Skills

Respond to security incidents in AWS, Azure, and GCP via identity-based containment, cloud-native log analysis (CloudTrail, Azure Activity Logs, GCP Audit Logs), resource isolation, and forensic…

mukul975/Anthropic-Cybersecurity-Skills

Respond to malware infections across enterprise endpoints by identifying the malware family, determining infection vectors, assessing spread, and executing containment, analysis, eradication, and…

mukul975/Anthropic-Cybersecurity-Skills

Respond to phishing incidents by analyzing reported emails, extracting indicators, sandboxing URLs/attachments, assessing credential compromise, quarantining malicious messages organization-wide…

mukul975/Anthropic-Cybersecurity-Skills

Deploy and operationalize Amazon GuardDuty, covering protection plans for S3, EKS, EC2 runtime monitoring, and Lambda, interpreting finding severity, and building automated response with EventBridge…

mukul975/Anthropic-Cybersecurity-Skills

Deploy and configure Zeek (formerly Bro) to passively analyze network traffic, generate structured connection/DNS/HTTP/SSL/file logs, detect anomalous behavior, and write custom scripts for…

mukul975/Anthropic-Cybersecurity-Skills

Detect WMI event subscription persistence (MITRE T1546.003) by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation…

mukul975/Anthropic-Cybersecurity-Skills

Extracts cached credentials, password hashes, Kerberos tickets, and authentication tokens from Windows memory dumps using Volatility 3, Mimikatz, and pypykatz.

mukul975/Anthropic-Cybersecurity-Skills

Detect DCSync attacks (MITRE ATT&CK T1003.006) by analyzing Windows Event ID 4662 (AccessMask 0x100) for DS-Replication-Get-Changes and DS-Replication-Get-Changes-All requests issued by…

mukul975/Anthropic-Cybersecurity-Skills

Develops OT-specific incident response playbooks using a SANS PICERL-based Python engine that classifies incident severity (safety, process, access, recon) and coordinates IT SOC, OT engineering…

mukul975/Anthropic-Cybersecurity-Skills

Implements Security Orchestration, Automation, and Response (SOAR) workflows using Splunk SOAR (formerly Phantom) to automate alert triage, IOC enrichment, containment actions, and incident response…

mukul975/Anthropic-Cybersecurity-Skills

Automates phishing incident response by calling the Splunk SOAR (Phantom) REST API to create containers, attach artifacts (emails, URLs, attachments), and trigger response playbooks.

mukul975/Anthropic-Cybersecurity-Skills

Executes a structured ransomware incident response from detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening, covering ransom negotiation…

mukul975/Anthropic-Cybersecurity-Skills

Performs tabletop exercises for SOC teams simulating security incidents through discussion-based scenarios to test incident response procedures, communication workflows, and decision-making under…

mukul975/Anthropic-Cybersecurity-Skills

Create structured incident response runbooks with step-by-step procedures, escalation paths, and recovery actions.

wshobson/agents

Master on-call shift handoffs with context transfer, escalation procedures, and documentation.

wshobson/agents

A skill your agent uses when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection.

alirezarezvani/claude-skills

Generate operational runbooks from a service name — deployment, incident response, maintenance, and rollback workflows.

alirezarezvani/claude-skills