initial-incident-intake-scoping

First-hour intake checklist + questions that produce an actionable scope and evidence plan.

Repositorio: tsale/awesome-dfir-skills
Última actividad en el origen: 27 de diciembre de 2025 a las 06:02
Idioma detectado de SKILL.md: inglés
Estrellas: 321
Forks: 35

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/tsale/awesome-dfir-skills --skill initial-incident-intake-scoping

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

admiralty-system

Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis. Use this skill whenever you need to evaluate a CTI report, breach claim, dark web forum post, threat actor advertisement, vendor blog, social media intel claim, leaked database listing, or any source plus information pair where trust matters. Trigger phrases include "assess this source", "rate this report", "is this breach real", "evaluate credibility", "source assessment", "should I trust this claim", "admiralty rating", "A1 to F6", and any review of CTI or OSINT material where you need to decide how much weight to give it. Use proactively when the user shares a breach post, threat actor claim, or vendor report and asks for analysis, even if they do not explicitly mention the Admiralty System. Also use when teaching, building courseware, or producing a training example around source evaluation.

2026-05-14

threat-actor-profiling

Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat actor, create a TA report, analyze an APT group, build an adversary profile, assess threat actor capability, map TTPs to MITRE ATT&CK for a specific group, or produce any intelligence deliverable about a threat actor. Also trigger when the user mentions threat actor names (e.g. APT29, Lazarus, FIN7), asks about victimology, modus operandi, or wants to structure threat intelligence around an adversary. This skill applies to both internal tracking profiles and incident-driven analytical deliverables.

2026-04-10

osquery-query-helper

Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.

2026-02-03

Ver todos los de este repositorio

id	triage.initial-incident-intake
name	Initial incident intake & scoping
description	First-hour intake checklist + questions that produce an actionable scope and evidence plan.
version	0.1.0
author	awesome-dfir-skills contributors
license	Apache-2.0
tags	["triage","case-management","scoping","first-hour"]
category	triage
platforms	["any"]
inputs	[{"name":"intake_notes","description":"Freeform notes from reporter: what happened, when, where, who noticed.","required":true},{"name":"environment_summary","description":"Org context: identity provider, EDR, email, cloud, logging, time zone.","required":false}]
outputs	[{"name":"scoped_incident_summary","description":"Short summary + working hypothesis + known/unknowns + next actions."},{"name":"evidence_request_list","description":"Concrete list of artifacts to request/collect next."}]