Jeden Skill in Manus ausführen
mit einem Klick

Jeden Skill in Manus mit einem Klick ausführen

Loslegen

initial-incident-intake-scoping

Sterne320

Forks36

Aktualisiert27. Dezember 2025 um 06:02

First-hour intake checklist + questions that produce an actionable scope and evidence plan.

Installation

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

In Manus ausführen

Quelle

tsale

tsale/awesome-dfir-skills

GitHub-Repository öffnen Creator-Repositorys ansehen

Download

In Manus ausführen

Verwandte BerufeSOC

Basierend auf der SOC-Berufsklassifikation

InformationssicherheitsanalystenInformatik- und Mathematikberufe·SOC 15-1212

SKILL.md

readonly

id	triage.initial-incident-intake
name	Initial incident intake & scoping
description	First-hour intake checklist + questions that produce an actionable scope and evidence plan.
version	0.1.0
author	awesome-dfir-skills contributors
license	Apache-2.0
tags	["triage","case-management","scoping","first-hour"]
category	triage
platforms	["any"]
inputs	[{"name":"intake_notes","description":"Freeform notes from reporter: what happened, when, where, who noticed.","required":true},{"name":"environment_summary","description":"Org context: identity provider, EDR, email, cloud, logging, time zone.","required":false}]
outputs	[{"name":"scoped_incident_summary","description":"Short summary + working hypothesis + known/unknowns + next actions."},{"name":"evidence_request_list","description":"Concrete list of artifacts to request/collect next."}]

Initial incident intake & scoping

What this skill does

Converts messy intake notes into a clear incident statement, assumptions, and immediate next actions.
Produces an evidence request list tailored to the suspected incident type.
Captures “known/unknowns” and identifies the critical time window.

When to use

New case creation / first response.
Handoff between SOC and IR.
You need to quickly decide: contain now vs. observe vs. wait for more evidence.

Safety / privacy notes

Don’t paste raw email bodies with PII unless necessary—prefer headers and redacted snippets.
Don’t paste credentials, secrets, access tokens.

Skill instructions

Role: You are a DFIR incident responder.

Task: Given the provided intake notes, produce a first-hour incident scope and evidence plan.

Rules:

If details are missing, ask targeted questions.

Don’t assume logging sources exist—confirm.

Use the reporter’s time zone; if unknown, call it out.

Provided intake notes: {{intake_notes}}

Environment summary (if any): {{environment_summary}}

Deliverables:

Incident summary (2–5 sentences)

Working hypothesis (what you think is happening + confidence)

Time window (earliest suspected activity → latest)

Known / Unknown (bullets)

Immediate containment considerations (safe, low-regret actions)

Evidence / logs to request next (prioritized, with WHY for each)

Next 60 minutes plan (checklist)

Evidence request starter list

Pick the relevant items based on incident type:

Identity (Entra/AD/Okta): sign-in logs, audit logs, MFA events, risky sign-ins
Email: message trace, headers, URL click logs, mailbox audit, rules/forwarding
Endpoints: EDR detections, timeline, process tree, network connections
Network: proxy/DNS logs, firewall flows, VPN logs
Cloud: CloudTrail / GCP audit logs / Azure activity, object storage access logs

Mehr aus diesem Repository

gleiches Repository

admiralty-system

tsale/awesome-dfir-skills

Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis. Use this skill whenever you need to evaluate a CTI report, breach claim, dark web forum post, threat actor advertisement, vendor blog, social media intel claim, leaked database listing, or any source plus information pair where trust matters. Trigger phrases include "assess this source", "rate this report", "is this breach real", "evaluate credibility", "source assessment", "should I trust this claim", "admiralty rating", "A1 to F6", and any review of CTI or OSINT material where you need to decide how much weight to give it. Use proactively when the user shares a breach post, threat actor claim, or vendor report and asks for analysis, even if they do not explicitly mention the Admiralty System. Also use when teaching, building courseware, or producing a training example around source evaluation.

2026-05-14321

threat-actor-profiling

tsale/awesome-dfir-skills

Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat actor, create a TA report, analyze an APT group, build an adversary profile, assess threat actor capability, map TTPs to MITRE ATT&CK for a specific group, or produce any intelligence deliverable about a threat actor. Also trigger when the user mentions threat actor names (e.g. APT29, Lazarus, FIN7), asks about victimology, modus operandi, or wants to structure threat intelligence around an adversary. This skill applies to both internal tracking profiles and incident-driven analytical deliverables.

2026-04-10321

osquery-query-helper

tsale/awesome-dfir-skills

Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.

2026-02-03321

malware-analysis

tsale/awesome-dfir-skills

Professional malware analysis workflow for PE executables and suspicious files. Triggers on file uploads with requests like "analyze this malware", "analyze this sample", "what does this executable do", "check this file for malware", or any request to examine suspicious files. Performs static analysis, threat intelligence triage, behavioral inference, and produces analyst-grade reports with reasoned conclusions.

2026-01-21321

analysing-attack

tsale/awesome-dfir-skills

Analyse Mitre ATT&CK tactics, techniques and sub-techniques. Use when performing analysis of threat detections, threat models, security risks or cyber threat intelligence

2026-01-08321

windows-intrusion-timeline-targeted

tsale/awesome-dfir-skills

Create a targeted intrusion timeline for a Windows incident using whatever artifacts are available (event logs, EDR, SIEM exports, triage notes).

2025-12-27321

Initial incident intake & scoping

What this skill does

Converts messy intake notes into a clear incident statement, assumptions, and immediate next actions.

Produces an evidence request list tailored to the suspected incident type.

Captures “known/unknowns” and identifies the critical time window.

When to use

New case creation / first response.

Handoff between SOC and IR.

You need to quickly decide: contain now vs. observe vs. wait for more evidence.

Safety / privacy notes

Don’t paste raw email bodies with PII unless necessary—prefer headers and redacted snippets.

Don’t paste credentials, secrets, access tokens.

Skill instructions

Role: You are a DFIR incident responder.

Task: Given the provided intake notes, produce a first-hour incident scope and evidence plan.

Rules:

If details are missing, ask targeted questions.
Don’t assume logging sources exist—confirm.
Use the reporter’s time zone; if unknown, call it out.

Provided intake notes: {{intake_notes}}

Environment summary (if any): {{environment_summary}}

Deliverables:

Incident summary (2–5 sentences)
Working hypothesis (what you think is happening + confidence)
Time window (earliest suspected activity → latest)
Known / Unknown (bullets)
Immediate containment considerations (safe, low-regret actions)
Evidence / logs to request next (prioritized, with WHY for each)
Next 60 minutes plan (checklist)

initial-incident-intake-scoping

Initial incident intake & scoping

What this skill does

When to use

Safety / privacy notes

Skill instructions

Suggested intake questions

Evidence request starter list

Initial incident intake & scoping

What this skill does

When to use

Safety / privacy notes

Skill instructions

Suggested intake questions

Evidence request starter list