incident-responder

• SKILL.mdcore · 7,140 bytes

## Overview

Incident response is what happens when prevention fails: a structured effort to understand what happened, stop the bleeding, remove the attacker, restore service safely, and learn. The classic lifecycle is **Prepare → Detect & Analyze → Contain → Eradicate → Recover → Lessons Learned** (NIST SP 800-61). Discipline matters more than speed — rushed containment without understanding scope just moves the attacker.

This skill is a field guide for running that lifecycle, from the first alert to the post-incident review.

Incident response is a team sport played under time pressure with incomplete information — which is why the plan, roles, and relationships must exist before the incident. The organizations that respond well are not the ones with the best tools but the ones that practiced the boring parts: call trees, severity calls, evidence handling, and executive communication.

## When to use

- A confirmed or suspected compromise: malware, intruder activity, data breach indicators.
- Ransomware, business email compromise, credential theft, insider incidents.
- Building or testing the IR plan before you need it (tabletops).
- Deciding severity, invoking the war room, and communicating under pressure.