responding-to-security-incidents

## Overview This skill empowers Claude to guide you through the security incident response process, ensuring a structured and effective approach to handling security breaches and attacks. It helps you classify incidents, develop response strategies, gather crucial evidence, and implement remediation steps to minimize damage and prevent future occurrences. ## How It Works 1. **Incident Classification**: Analyzes the incident details to determine the type, severity, and scope of the security event. 2. **Playbook Generation**: Creates a tailored response playbook based on the incident classification, outlining the necessary steps for containment, eradication, and recovery. 3. **Evidence Gathering**: Provides guidance on collecting relevant logs, network data, and forensic evidence to support the investigation. 4. **Remediation Planning**: Develops a detailed plan for remediating the vulnerabilities exploited during the incident and restoring affected systems. ## When to Use This Skill This skill activates when you need to: - Respond to a suspected security breach or attack. - Develop an incident response plan. - Investigate a security incident and gather evidence. - Remediate vulnerabilities exploited during a security incident. - Generate a post-incident report and lessons learned. ## Examples ### Example 1: Responding to a Ransomware Attack User request: "We've been hit with a ransomware attack. What should we do?" The skill will: 1. Classify the incident as a ransomw...