Security Incident Triage and Containment
Get a severity assessment, containment plan, escalation brief, and evidence checklist for an active security incident.
Before & after
Same prompt, same agent — the only difference is the skill.
That does sound concerning. It could be a few different things: maybe it's a legitimate bot or automated tool that's misbehaving, or possibly a malicious actor probing your system. You'll want to investigate this further to understand what's happening. I'd suggest reviewing your logs to see what endpoints were being hit and what data might have been accessed. You should probably contact your security team if you have one, and they can help you figure out the right response. Do you have any other indicators of compromise? Are there any other suspicious patterns you've noticed?
INCIDENT CLASSIFICATION: Severity: SEV2 (elevated suspicious activity, no confirmed breach) Taxonomy: Rate-limit bypass + reconnaissance scan False-positive check: No — pattern violates normal API usage by 15000 percent, single-source concentration indicates adversarial behavior TRIAGE RESULTS: • IP 203.45.102.117 was NOT in previous whitelist • Request cadence: 333 req/sec for 30 minutes (burst pattern, not gradual) • Endpoints targeted: /users (42 percent), /api/keys (38 percent), /admin/config (20 percent) — reconnaissance profile • No successful authentication detected • Rate limiter returned 429 after 2,145 requests; attacker cycled through proxies (6 distinct User-Agents) ESCALATION PATH: → Immediate: Block IP range 203.45.0.0/16, review all /admin/config queries in past 24 hours → Within 2 hours: Check if any credentials were leaked in this request stream → Within 4 hours: Run forensic scan on user endpoints for data exfiltration attempts NIST SP 800-61 PHASE: Detection (containing) → Analysis → Containment
About this skill
“Is this a real incident, who needs paging, and what can we touch without destroying evidence?” Turn an ambiguous security alert into a prioritized response with explicit uncertainty, scoped containment options, and a usable escalation brief.
What it does
- Assigns provisional SEV1-SEV4 severity using impact, attacker access, blast radius, and evidence confidence.
- Tests benign explanations without delaying action against credible ongoing harm.
- Orders containment and evidence collection around urgency, volatility, and service dependencies.
- Identifies escalation roles, decision owners, and conditions for raising or lowering severity.
- Builds an evidence register with source, collection time, integrity checks, and custody details.
- Defines recovery gates and concrete checks before declaring the incident resolved.
What you get
A situation-specific response: what is known, what to do next, who should own each action, and what evidence to preserve. For a quick question, you get the immediate decision and its rationale; for a declared incident, you get a working response brief and timeline.
Best for
Security responders, on-call engineers, platform teams, and technical leads handling suspicious access, compromised credentials, malware, unexpected data movement, or other potential security incidents.
SKILL.md preview
---
name: security-incident-triage-and-containment
description: Classify a detected security incident, choose containment actions, map escalation roles, and preserve forensic evidence using impact-based severity and explicit decision gates. Use when the user says "is this a security incident?", "triage this alert", "we may have leaked credentials", "our server keeps making suspicious outbound connections", "what should we preserve before restarting?", "who needs to be paged?", or "help us contain this breach".
---
# Security Incident Triage and Containment
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.