incident-response
Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.
Profile →npx skills add alirezarezvani/claude-skills --skill incident-response --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Incident Response Incident response skill for the full lifecycle from initial triage through forensic collection, severity declaration, and escalation routing. This is NOT threat hunting (see threat-detection) or post-incident compliance mapping (see governance/compliance-mapping) — this is about classifying, triaging, and managing declared security incidents. --- ## Table of Contents - [Overview](#overview) - [Incident Triage Tool](#incident-triage-tool) - [Incident Classification](#incident-classification) - [Severity Framework](#severity-framework) - [False Positive Filtering](#false-positive-filtering) - [Forensic Evidence Collection](#forensic-evidence-collection) - [Escalation Paths](#escalation-paths) - [Regulatory Notification Obligations](#regulatory-notification-obligations) - [Workflows](#workflows) - [Anti-Patterns](#anti-patterns) - [Cross-References](#cross-references) --- ## Overview ### What This Skill Does This skill provides the methodology and tooling for **incident triage and response** — classifying security events into typed incidents, scoring severity, filtering false positives, determining escalation paths, and initiating forensic evidence collection under
- Table of Contents
- Overview
- What This Skill Does
- Distinction from Other Security Skills
- Prerequisites
- Incident Triage Tool
- Input Event Schema
- Exit Codes
- Incident Classification
- Incident Taxonomy
- SEV Escalation Triggers
- Severity Framework
- SEV Level Matrix
- False Positive Filtering
Classify an event from JSON file
python3 scripts/incident_triage.py --input event.json --classify --json
Classify with false positive filtering enabled
python3 scripts/incident_triage.py --input event.json --classify --false-positive-check --json
Force a severity level for tabletop exercises
python3 scripts/incident_triage.py --input event.json --severity sev1 --json
Read event from stdin
echo '{"event_type": "ransomware", "host": "prod-db-01", "raw_payload": {}}' | \
python3 scripts/incident_triage.py --classify --false-positive-check --json
python3 scripts/incident_triage.py --input alert.json \What does the incident-response skill do?
Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.
How do I install it?
Run `npx skills add alirezarezvani/claude-skills --skill incident-response --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From alirezarezvani/claude-skills, a repository with 23,791 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.