Individual skill
triaging-security-incident-with-ir-playbook
Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.
internal/tools/skills/data/incident-response/triaging-security-incident-with-ir-playbook/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,325
- Repository last updated
- Nov 9, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- incident-response Declared skill tag
- triage Declared skill tag
- playbook Declared skill tag
- severity-classification Declared skill tag
- soc Declared skill tag
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Triaging Security Incidents with IR Playbooks
## When to Use
- New security alert received from SIEM, EDR, or other detection sources
- SOC analyst needs to determine if an alert is a true positive requiring response
- Incident needs severity classification and team assignment
- Multiple concurrent incidents require prioritization
- Automated triage rules need validation or tuning
## Detection Gaps & Validation
- **Enrichment context, not just reputation, drives severity:** a "clean" VirusTotal/AbuseIPDB result does not downgrade an alert — newly registered C2 and fast-flux infrastructure often have zero detections. Validate against asset criticality (CMDB), data classification, and whether the threat is *active* vs historical before assigning P1-P4.
- **The most-missed triage error is closing the alert in isolation:** before calling true/false positive, pivot — same src/dest IP, same user, same hash across the last 30 days. A single brute-force or "quarantined malware" alert is frequently one node of a broader intrusion (lateral movement, persistence) that single-alert triage buries.
- **Confirm the alert maps to the right playbook:** signature names lie. Decode the payload, resolve the MITRE technique, and verify the trigger conditions actually match before launching a playbook — a mis-categorized incident routes to the wrong team and burns SLA.