Skip to main content الرئيسية المنشئون yanacuti1121 yana-ai triaging-security-incident-with-ir-playbook
triaging-security-incident-with-ir-playbook Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.
الانتقال إلى التثبيت سوق المهارات اكتشف واستكشف مهارات الذكاء الاصطناعي التي بناها المجتمع.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
عرض تفاصيل Prompt يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/yanacuti1121/Yana-AI --skill triaging-security-incident-with-ir-playbookيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
تحميل Zip جاري التحميل... المزيد من هذا المستودع Sovereign-grade safety OS for AI coding agents. 62 hooks, 2,025 skills, L1 memory, circuit breakers, and cross-engine enforcement — blocks rm -rf, force push, pipe-to-shell, and 40+ attack vectors before they reach your repo.
Use when the user wants to generate or keep repository documentation up to date via OpenWiki (langchain-ai/openwiki) — an LLM-driven CLI that writes a wiki for a codebase (or a personal knowledge base from Notion/Gmail/Slack/X/web search) and keeps it fresh via a scheduled CI pull request. Examples: "set up OpenWiki for this repo", "keep the docs updated automatically", "generate an agent wiki".
augmented-reality-from-scratch Use when implementing the core AR pipeline (camera pose estimation, marker tracking, projection overlay) from first principles — not when just using ARKit/ARCore/Unity's AR framework as a black box. Triggers on: 'build augmented reality from scratch', 'marker-based AR tracking', 'camera pose estimation', 'implement fiducial marker detection', 'AR projection matrix math', 'markerless AR tracking'. Covers marker-based vs markerless tracking, pose estimation, and the projection math to overlay 3D content on a camera feed.
المهن ذات الصلة SOC
استنادا إلى تصنيف SOC المهني
name triaging-security-incident-with-ir-playbook description Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures. domain cybersecurity subdomain incident-response tags ["incident-response","triage","playbook","severity-classification","soc"] mitre_attack ["T1486","T1490","T1070","T1078"] version 1.0 author mahipal license Apache-2.0 nist_csf ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] source https://github.com/mukul975/Anthropic-Cybersecurity-Skills source_commit 04450304b12645cb2b974ab96d28c0664758a88d
Triaging Security Incidents with IR Playbooks
When to Use
New security alert received from SIEM, EDR, or other detection sources
SOC analyst needs to determine if an alert is a true positive requiring response
Incident needs severity classification and team assignment
Multiple concurrent incidents require prioritization
Automated triage rules need validation or tuning
Prerequisites
SIEM platform with alert correlation (Splunk, Elastic, QRadar, Sentinel)
Incident response playbook library (by incident type)
Severity classification matrix approved by CISO
On-call rotation and escalation procedures
Ticketing system for incident tracking (ServiceNow, Jira, TheHive)
Threat intelligence feeds for IOC enrichment
Workflow
Step 1: Receive and Acknowledge Alert
index=notable status=new severity IN ("critical" ,"high" )
| table _time, rule_name, src, dest, severity, description
| sort -_time
curl -s -H "Authorization: Bearer $THEHIVE_API_KEY " \
"https://thehive.local/api/v1/query?name=list-alerts" \
-H "Content-Type: application/json" \
-d '{"query":[{"_name":"listAlert"},{"_name":"filter","_field":"status","_value":"New"}]}'
curl -X POST "https://splunk.local:8089/services/notable_update" \
-H "Authorization: Bearer $SPLUNK_TOKEN " \
-d "ruleUIDs=$RULE_UID &status=1&comment=Triage+initiated+by+analyst"
Step 2: Enrich Alert Data
curl -s "https://www.virustotal.com/api/v3/ip_addresses/$SRC_IP " \
-H "x-apikey: $VT_API_KEY " | jq '.data.attributes.last_analysis_stats'
"https://api.abuseipdb.com/api/v2/check?ipAddress=$SRC_IP &maxAgeInDays=90"
"Key: $ABUSEIPDB_KEY "
"Accept: application/json"
'.data'
"https://www.virustotal.com/api/v3/files/$FILE_HASH "
"x-apikey: $VT_API_KEY "
'.data.attributes.last_analysis_stats'
"https://cmdb.local/api/assets?ip=$DEST_IP "
"Authorization: Bearer $CMDB_TOKEN "
'.asset_criticality, .owner, .environment'
Step 3: Classify Incident Type
grep -i "$ALERT_SIGNATURE " /opt/ir/playbooks/trigger_conditions.yaml
curl -s "https://attack.mitre.org/api/techniques/$TECHNIQUE_ID " | jq '.name, .tactic'
Step 4: Assign Severity Level
python3 -c "
severity_score = 0
# Asset criticality: Critical=4, High=3, Medium=2, Low=1
severity_score += 4 # Critical server
# Data sensitivity: PII/PHI=4, PCI=3, Confidential=2, Public=1
severity_score += 3 # PCI data
# Scope: Enterprise=4, Department=3, Single system=2, Single user=1
severity_score += 2 # Single system
# Threat status: Active=4, Recent=3, Historical=2, Potential=1
severity_score += 4 # Active threat
if severity_score >= 12: print('CRITICAL - P1')
elif severity_score >= 9: print('HIGH - P2')
elif severity_score >= 6: print('MEDIUM - P3')
else: print('LOW - P4')
print(f'Score: {severity_score}/16')
"
Step 5: Select and Initiate Playbook
cat /opt/ir/playbooks/ransomware_playbook.yaml
cat /opt/ir/playbooks/phishing_playbook.yaml
cat /opt/ir/playbooks/unauthorized_access_playbook.yaml
curl -X POST "https://thehive.local/api/v1/case" \
-H "Authorization: Bearer $THEHIVE_API_KEY " \
-H "Content-Type: application/json" \
-d '{
"title": "IR-2024-XXX: [Incident Type] - [Brief Description]",
"description": "Triage summary and initial findings",
"severity": 3,
"tlp": 2,
"pap": 2,
"tags": ["ransomware", "triage-complete"],
"customFields": {
"playbook": {"string": "ransomware_v2"},
"affected_systems": {"integer": 5}
}
}'
Step 6: Assign Response Team
curl -s "https://pagerduty.com/api/v2/oncalls?schedule_ids[]=$SCHEDULE_ID " \
-H "Authorization: Token token=$PD_TOKEN " | jq '.oncalls[].user.summary'
curl -X POST "https://events.pagerduty.com/v2/enqueue" \
-H "Content-Type: application/json" \
-d '{
"routing_key": "' $PD_ROUTING_KEY '",
"event_action": "trigger",
"payload": {
"summary": "P1 Security Incident: Ransomware detected on PROD-DB-01",
"severity": "critical",
"source": "SIEM-Splunk",
"custom_details": {"incident_id": "IR-2024-042", "playbook": "ransomware_v2"}
}
}'
Step 7: Document Triage Decision and Hand Off
curl -X PATCH "https://thehive.local/api/v1/case/$CASE_ID " \
-H "Authorization: Bearer $THEHIVE_API_KEY " \
-H "Content-Type: application/json" \
-d '{
"status": "InProgress",
"customFields": {
"triage_analyst": {"string": "analyst_name"},
"triage_time": {"date": ' $(date +%s000)'},
"severity_justification": {"string": "Critical asset + active threat + PCI data"}
}
}'
Key Concepts Concept Description True Positive Alert correctly identifying a real security incident False Positive Alert incorrectly flagging benign activity as malicious Severity Classification Ranking incident priority based on impact and urgency Playbook Selection Choosing the appropriate response procedure based on incident type IOC Enrichment Adding context to indicators from threat intelligence sources Escalation Threshold Criteria triggering escalation to higher severity or management Triage SLA Time target for initial assessment (typically 15-30 min for critical)
Tools & Systems Tool Purpose Splunk/Elastic/QRadar SIEM alert correlation and querying TheHive/SIRP Incident case management and playbook tracking VirusTotal/AbuseIPDB IOC reputation and enrichment PagerDuty/OpsGenie On-call management and alerting MITRE ATT&CK Technique classification and mapping Cortex XSOAR SOAR platform for automated triage workflows
Common Scenarios
Brute Force Alert : Multiple failed logins from single IP. Enrich IP reputation, check geo-location, verify if account was compromised, assign P3 if unsuccessful.Malware Detection on Endpoint : AV/EDR quarantined malware. Verify quarantine success, check for lateral movement, assign P2 if persistence detected.Suspicious Outbound Traffic : Large data transfer to unknown external IP. Check if known cloud service, verify data classification, assign P1 if exfiltration confirmed.Phishing Email Reported : User reports suspicious email. Extract IOCs, check if others received it, assign P2 if credentials were entered.Privilege Escalation : User gained admin rights unexpectedly. Verify if authorized change, check for exploitation, assign P1 if unauthorized.
Output Format
Triage decision document with severity justification
Incident ticket with assigned playbook and team
IOC enrichment summary attached to case
Escalation notification to appropriate stakeholders
Initial timeline of events from alert data
