メニュー
First-hour intake checklist + questions that produce an actionable scope and evidence plan.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/tsale/awesome-dfir-skills --skill initial-incident-intake-scopingコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis. Use this skill whenever you need to evaluate a CTI report, breach claim, dark web forum post, threat actor advertisement, vendor blog, social media intel claim, leaked database listing, or any source plus information pair where trust matters. Trigger phrases include "assess this source", "rate this report", "is this breach real", "evaluate credibility", "source assessment", "should I trust this claim", "admiralty rating", "A1 to F6", and any review of CTI or OSINT material where you need to decide how much weight to give it. Use proactively when the user shares a breach post, threat actor claim, or vendor report and asks for analysis, even if they do not explicitly mention the Admiralty System. Also use when teaching, building courseware, or producing a training example around source evaluation.
Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat actor, create a TA report, analyze an APT group, build an adversary profile, assess threat actor capability, map TTPs to MITRE ATT&CK for a specific group, or produce any intelligence deliverable about a threat actor. Also trigger when the user mentions threat actor names (e.g. APT29, Lazarus, FIN7), asks about victimology, modus operandi, or wants to structure threat intelligence around an adversary. This skill applies to both internal tracking profiles and incident-driven analytical deliverables.
Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.
SOC 職業分類に基づく
SKILL.md を表示中
| id | triage.initial-incident-intake |
| name | Initial incident intake & scoping |
| description | First-hour intake checklist + questions that produce an actionable scope and evidence plan. |
| version | 0.1.0 |
| author | awesome-dfir-skills contributors |
| license | Apache-2.0 |
| tags | ["triage","case-management","scoping","first-hour"] |
| category | triage |
| platforms | ["any"] |
| inputs | [{"name":"intake_notes","description":"Freeform notes from reporter: what happened, when, where, who noticed.","required":true},{"name":"environment_summary","description":"Org context: identity provider, EDR, email, cloud, logging, time zone.","required":false}] |
| outputs | [{"name":"scoped_incident_summary","description":"Short summary + working hypothesis + known/unknowns + next actions."},{"name":"evidence_request_list","description":"Concrete list of artifacts to request/collect next."}] |
Role: You are a DFIR incident responder.
Task: Given the provided intake notes, produce a first-hour incident scope and evidence plan.
Rules:
- If details are missing, ask targeted questions.
- Don’t assume logging sources exist—confirm.
- Use the reporter’s time zone; if unknown, call it out.
Provided intake notes: {{intake_notes}}
Environment summary (if any): {{environment_summary}}
Deliverables:
- Incident summary (2–5 sentences)
- Working hypothesis (what you think is happening + confidence)
- Time window (earliest suspected activity → latest)
- Known / Unknown (bullets)
- Immediate containment considerations (safe, low-regret actions)
- Evidence / logs to request next (prioritized, with WHY for each)
- Next 60 minutes plan (checklist)
Pick the relevant items based on incident type:
