| name | incident-respond |
| description | End-to-end incident-response playbook for a CVE actively in the wild — confirms urgency via KEV/EPSS/sightings, pulls IOCs and ATT&CK chain, fetches detection rules for installed families, evaluates patch path or workarounds, generates VEX attestation, posts a consolidated report. Use when a CVE goes hot, your dependency is named in a vendor advisory, or the team needs a one-conversation SOC response. |
| argument-hint | <vuln-id> |
| user-invocable | true |
| allowed-tools | Bash, Read, Glob, Grep, Edit, Write |
| model | sonnet |
| triggers | ["incident","actively exploit","zero day","in the wild"] |
| chain | ["detection-rules","verify-fix","vex-publish"] |
| outputBudget | long |
| cooldown | per-session |
Vulnetix Incident Response Skill
Use when
- A CVE went hot overnight and you need a complete SOC response in one conversation.
- A vendor advisory names a dependency you ship.
- Active sightings spiked (CrowdSec, Shadowserver) on a vuln you have.
- Building the timeline of "what we knew when" for a post-incident review.
- Coordinating detection + patch + VEX in a single workflow.
Don't use for
- Routine triage — use
/vulnetix:soc-triage.
- Single-step actions — use the constituent skills directly (
/vulnetix:fix, /vulnetix:detection-rules, etc.).
- For dormant CVEs (no recent sightings, not in KEV) — the skill exits early and recommends
/vulnetix:remediation instead.
Conventions
This skill follows _lib/contract.md: the Vulnetix CLI is auto-installed by hooks, .vulnetix/capabilities.yaml is always present, every vulnetix vdb call is piped through a verified jq filter from _lib/jq/, independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns.
A focused playbook when a CVE is hot. Composes IOC pivot, detection rules, fix planning, and VEX in a single linear flow.
Step 1: Load capabilities + memory
Read .vulnetix/capabilities.yaml and .vulnetix/memory.yaml. Capture detection_stack, soar, and any prior data on the vuln.
Step 2: Confirm urgency
vulnetix vdb sightings "$ARGUMENTS" -o json | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/sightings.jq"
vulnetix vdb kev get "$ARGUMENTS" -o json 2>/dev/null | jq -f "${CLAUDE_PLUGIN_ROOT}/skills/_lib/jq/kev.jq"
Decide: active (sightings within 30 days OR in KEV) → run all steps. dormant → suggest /vulnetix:remediation instead and exit.
