---

name: incident-response description: Use when Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection.

Incident Response

Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle. — One of 337+ skills in Ali Reza's multi-agent claude-skills collection (Claude, Codex, Gemini, Hermes; ~19k stars).

What you get

• Public GitHub repo (alirezarezvani/claude-skills)
• the incident-response skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.

Customize your output

• Fork the repo and adapt the skill's instructions and references to your workflow.

Example output

Activates automatically when your request matches Incident Response; chains with the other skills, agents, and commands in the collection.

Best for

Creators, builders, and teams using Claude Code.