Best incident response skills, page 3

A skill your agent uses when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when a security request needs routing to the…

alirezarezvani/claude-skills

VP of Engineering advisory for startups: delivery throughput (DORA 4 metrics + bottleneck identification), engineering hiring funnel (sourcing → screen → onsite → offer conversion + time-to-fill +…

alirezarezvani/claude-skills

Visualize Rust function call graphs using LSP. An agent skill from fjrevoredo/mini-diarium.

fjrevoredo/mini-diarium

Guide incident response from detection to post-mortem using SRE principles, severity classification, on-call management, blameless culture, and communication protocols.

ancoleman/ai-design-components

Manages IT infrastructure, monitoring, incident response, and service reliability.

davila7/claude-code-templates

Production-ready templates for incident response runbooks covering detection, triage, mitigation, resolution, and communication.

aiskillstore/marketplace

Effective patterns for on-call shift transitions, ensuring continuity, context transfer, and reliable incident response across shifts.

aiskillstore/marketplace

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

mukul975/Anthropic-Cybersecurity-Skills

Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

mukul975/Anthropic-Cybersecurity-Skills

Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS…

mukul975/Anthropic-Cybersecurity-Skills

Perform forensic acquisition of cloud storage services including Google Drive, OneDrive, Dropbox, and Box by pulling API-based remote data such as revision history and audit logs, and collecting…

mukul975/Anthropic-Cybersecurity-Skills

Automates the full SSL/TLS certificate lifecycle, including generating Certificate Signing Requests, issuing, deploying, monitoring, renewing, and revoking X.509 certificates, using Python and ACME…

mukul975/Anthropic-Cybersecurity-Skills

The Common Vulnerability Scoring System (CVSS) is the industry standard framework maintained by FIRST (Forum of Incident Response and Security Teams) for assessing vulnerability severity.

mukul975/Anthropic-Cybersecurity-Skills

Inspects Filestore capacity and utilization on Google Cloud, evaluates storage scaling rules, and performs capacity autoscaling (scale UP for low free space or scale DOWN for cost optimization).

google/skills

Expert DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observability.

aiskillstore/marketplace

Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and…

mukul975/Anthropic-Cybersecurity-Skills

Executes containment strategies to stop active adversary operations and prevent lateral movement during a confirmed security breach.

mukul975/Anthropic-Cybersecurity-Skills

Uses Rekall memory forensics framework to analyze memory dumps for process hollowing, injected code via VAD anomalies, hidden processes, and rootkit detection.

mukul975/Anthropic-Cybersecurity-Skills

Hunts for MITRE ATT&CK T1098 account manipulation - shadow admin creation, SID history injection, group membership changes, and credential modifications - by analyzing Windows Security Event Log IDs…

mukul975/Anthropic-Cybersecurity-Skills

Detects suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event log Event ID 7045, analyzing service binary paths, and flagging indicators of persistence mechanisms…

mukul975/Anthropic-Cybersecurity-Skills

Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into…

mukul975/Anthropic-Cybersecurity-Skills

Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal API v3 to retrieve multi-engine detection rates, sandbox behavioral analysis, YARA rule matches, related indicators, and…

mukul975/Anthropic-Cybersecurity-Skills

Analyze volatile memory (RAM) dumps using the Volatility 3 framework to extract running processes, network connections, loaded modules, credentials, and encryption keys, and to detect process…

mukul975/Anthropic-Cybersecurity-Skills

A skill your agent uses when setting up a new project's production observability stack, reviewing incident response readiness, or investigating why errors are going undetected.

thedaviddias/Front-End-Checklist

Triage PostHog error tracking issues during a daily or on-call review.

PostHog/posthog

A skill your agent uses when training SDRs on calls, building call frameworks, or handling common phone scenarios — a 1-minute cold call script in 5 steps, a no-show phone script, and objection…

swan-gtm/gtm-skills

Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response.

c0x12c/ai-toolkit

A skill your agent uses when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem.

github/awesome-copilot

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response.

aiskillstore/marketplace

Triage an outage, loss of stakeholder trust or a failing engagement direction.

suboss87/FDEOps

Diagnose and respond to production incidents. An agent skill from agulli/atlas-agents.

agulli/atlas-agents

Group food ordering through the DoorDash CLI (dd-cli) from a persistent team roster.

davila7/claude-code-templates

Guide rapid triage and initial response to security incidents following NIST SP 800-61 methodology.

briiirussell/cybersecurity-skills

Build, run, and improve a Security Operations Center — alert prioritization, runbook authoring, escalation criteria, on-call structure, alert tuning workflow, MTTD / MTTR / fidelity KPIs, analyst…

briiirussell/cybersecurity-skills

Design and run a monitoring system for a website or web app.

rampstackco/claude-skills

A skill your agent uses when working with incident response incident response

aiskillstore/marketplace

Route alerts, run on-call rotations, and drive incidents in Grafana IRM / OnCall — integrations (Alertmanager / Grafana Alerting / generic webhook / PagerDuty), Jinja2 routing + grouping templates…

grafana/skills

[Extended thinking: This workflow implements a sophisticated debugging and resolution pipeline that leverages AI-assisted debugging tools and observability platforms to systematically diagnose and res

aiskillstore/marketplace

Scan Linux systems for persistence mechanisms including crontab/systemd entries, LDPRELOAD injection, shell profile modifications (.bashrc, .profile), and SSH authorizedkeys backdoors, then…

mukul975/Anthropic-Cybersecurity-Skills

Create operational playbooks for incident response, deployments, and maintenance during PRD v0.8 Deployment & Ops.

mattgierhart/PRD-driven-context-engineering

Triage playbook for when cold email deliverability breaks. An agent skill from growthenginenowoslawski/coldoutboundskills.

growthenginenowoslawski/coldoutboundskills

Design, audit, or implement application structured logging architecture from repository evidence.

majiayu000/spellbook

[omh] Production is down or an incident is open: command an incident that is still open -- severity as declared live state, commander and roles, an append-only timeline, a recorded temporary…

rlaope/oh-my-hermes

An engineering runbook — service overview, alerts table, dashboards links, common procedures with copy-pasteable commands, on-call rotation, and an incident-response checklist.

sanqiufong/slides-from-anything

Generates operations-focused guidance for Google Cloud workloads based on the design principles and recommendations in the Operational Excellence pillar of the Google Cloud Well-Architected…

google/skills

Promote a QA'd Sculptor release candidate to a full production release: verify the RC build is green and has been QA'd, then from the release branch run just promote-release (which strips the rcN…

imbue-ai/sculptor

WARNING: guides potentially IRREVERSIBLE BlueField-4 hardware operations (PLDM firmware burns, ISO reflashes, power cycles, BMC factory resets) that can brick firmware, corrupt boot media, or cause…

NVIDIA/skills

Extracts and analyzes browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge using sqlite3, DB Browser for SQLite, Hindsight, and NirSoft tools…

mukul975/Anthropic-Cybersecurity-Skills