Incident Response — Security & Safety

This skill provides a structured methodology for incident response, covering classification, triage, severity scoring, false positive filtering, escalation paths, and forensic evidence collection. It includes a command-line tool for automated triage and produces actionable outputs like severity levels, escalation paths, and forensic findings.

engineering claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Classifies security events into 14 incident types with default severities and response SLAs.
Scores severity using a SEV1-SEV4 framework with automatic escalation triggers.
Applies five false positive filters (CI/CD, test env, scheduled jobs, whitelisted identities, scanners).
Provides forensic evidence collection guidance following DFRWS phases and volatile-first acquisition.
Defines escalation paths by severity and incident type, including regulatory notification deadlines.
Includes a triage tool (incident_triage.py) with exit codes for automated response routing.

🎯 When to use it

When a security incident has been detected or declared and needs classification and triage.
When determining the severity level (SEV1-SEV4) and escalation path for a security event.
When filtering false positives before escalating alerts to avoid alert fatigue.
When initiating forensic evidence collection with chain-of-custody controls.
When needing to understand regulatory notification obligations for a data breach.

🚀 How to use

Trigger the skill by describing a security incident or using the provided Python tool. Input a JSON event payload with fields like event_type, host, user, source_ip, timestamp, and raw_payload. Run the tool with flags like --classify and --false-positive-check to get classification and severity. Example prompts:

python3 scripts/incident_triage.py --input event.json --classify --false-positive-check --json

echo '{"event_type": "ransomware", "host": "prod-db-01"}' | python3 scripts/incident_triage.py --classify --json

📄 Output: The skill produces a triage output with incident classification, severity, escalation path, false positive flag, and forensic findings, typically as JSON.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering-team/skills/incident-response .claude/skills/incident-response

Skill source: engineering-team/skills/incident-response/SKILL.md

⚠️ Good to know

Requires a security event to be ingested first; it is not for threat hunting or compliance mapping, and assumes the user has access to the incident_triage.py script.

❓ FAQ

What are the exit codes of the triage tool?

Exit code 0 means SEV3/SEV4 or clean, 1 means SEV2 requiring a 1-hour bridge call, and 2 means SEV1 requiring an immediate 15-minute war room.

When does the regulatory notification clock start?

The notification clock starts at incident declaration, not at investigation completion.

What is the first step in forensic evidence collection?

Collect volatile evidence first, such as live memory, running processes, and network connections, before containment actions.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.