Incident Response
Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection.
Before & after
Same prompt, same agent — the only difference is the skill.
That does sound concerning. It could be a few different things: maybe it's a legitimate bot or automated tool that's misbehaving, or possibly a malicious actor probing your system. You'll want to investigate this further to understand what's happening. I'd suggest reviewing your logs to see what endpoints were being hit and what data might have been accessed. You should probably contact your security team if you have one, and they can help you figure out the right response. Do you have any other indicators of compromise? Are there any other suspicious patterns you've noticed?
INCIDENT CLASSIFICATION: Severity: SEV2 (elevated suspicious activity, no confirmed breach) Taxonomy: Rate-limit bypass + reconnaissance scan False-positive check: No — pattern violates normal API usage by 15000 percent, single-source concentration indicates adversarial behavior TRIAGE RESULTS: • IP 203.45.102.117 was NOT in previous whitelist • Request cadence: 333 req/sec for 30 minutes (burst pattern, not gradual) • Endpoints targeted: /users (42 percent), /api/keys (38 percent), /admin/config (20 percent) — reconnaissance profile • No successful authentication detected • Rate limiter returned 429 after 2,145 requests; attacker cycled through proxies (6 distinct User-Agents) ESCALATION PATH: → Immediate: Block IP range 203.45.0.0/16, review all /admin/config queries in past 24 hours → Within 2 hours: Check if any credentials were leaked in this request stream → Within 4 hours: Run forensic scan on user endpoints for data exfiltration attempts NIST SP 800-61 PHASE: Detection (containing) → Analysis → Containment
About this skill
name: incident-response description: Use when Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection.
Incident Response
Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the incident-response skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Incident Response; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
---
name: incident-response
description: Use when a security incident has been detected or declared and needs classification, triage, escalation-path determination, and forensic evidence collection.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Incident Response
Classifies and triages a declared or detected security incident, determines the correct escalation path, and guides forensic evidence collection following an incident lifecycle model.
## When to use
… (sign up to view the full skill)More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.