Results for “incident-report”

Writes internal communications such as status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, and project updates, following company-specific formats.

Generates video analysis reports by routing to a VLM backend for per-clip analysis or an analytics backend for incident-range reports, with deployment profile verification and URL rewriting.

Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages, and remediating affected accounts.

Write consistent, high-quality internal communications (status reports, 3P updates, newsletters, FAQs, incident reports). Use company standards and formats for all internal messaging.

Write business reports including executive summaries, status updates, postmortems, competitive analyses, data analyses, and quarterly reviews. Use when communicating findings, decisions, or status to stakeholders. Also trigger for 'executive summary', 'status report', 'postmortem', 'incident report', 'competitive analysis', 'quarterly review', 'business report', or 'data analysis report'.

Applies the DORA framework to manage ICT risk and operational resilience for EU financial entities, covering governance, incident reporting, resilience testing, third-party risk, and threat intelligence sharing.

Plans and facilitates tabletop exercises simulating ransomware incidents to test organizational readiness, decision-making, and communication procedures.

Generate professional reports — sprint retrospectives, financial summaries, analytics dashboards, and incident postmortems — from structured data with templates, charts, and multi-format output. Use when the user requests report generation or provides relevant inputs for this workflow.

Analyze WAF logs from ModSecurity, AWS WAF, or Cloudflare to detect SQL injection attack campaigns, classify injection types, and generate incident reports with OWASP classification.

Guide a team through writing a structured, blameless post-mortem after a production incident, covering timeline reconstruction, root cause analysis, impact quantification, and action item generation.

Runbook skill for failures: cron error, PA failure, cascade, gateway disconnect, semantic DB stale. Walks: detect → classify → diagnose → notify → log. Replaces ad-hoc failure handling. Triggers: "cron failed", "X is broken", "cascade", "incident", "gateway down", "PA failure".

Conduz investigação de incidentes com método: triagem, hipóteses, mitigação, RCA e postmortem, priorizando evidências e confirmação humana.

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

Use when detecting, responding to, or recovering from system failures, outages, security breaches, or critical errors. This skill provides a structured incident response process for any type of failure, ensuring consistent handling, communication, and post-incident learning.

Capture delivery evidence, commands, changed files, blockers, and standards feedback after a work session.

Classify, triage, and manage declared security incidents from initial triage through forensic evidence collection and escalation routing.

OI-3 spike harness — heavy consumer skill, INLINE arm. Builds an incident post-mortem and sources the readability standard mid-workflow via an inline (non-forked) guidance skill. Use only when explicitly invoked by the spike harness with a TRIAL_ID and data path.

Incident Post-Mortem Builder

Security leadership for growth-stage companies. Risk quantification in dollars, compliance roadmap (SOC 2/ISO 27001/HIPAA/GDPR), security architecture strategy, incident response leadership, and board-level security reporting. Use when building security programs, justifying security budget, selecting compliance frameworks, managing incidents, assessing vendor risk, or when user mentions CISO, security strategy, compliance roadmap, zero trust, or board security reporting.

Investigate phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms.

Incident response mode — diagnose a production issue, write a postmortem, add follow-up tasks to TODO.md. Use when user says "/incident [description]".

**Server Logs:**

OI-3 spike harness — heavy consumer skill, BASELINE arm. Builds an incident post-mortem and sources the readability standard mid-workflow by reading a file directly, with NO Skill-tool call. Use only when explicitly invoked by the spike harness with a TRIAL_ID and data path.

Helps users report issues with GTM skills — incorrect advice, broken activation, missing context, or unexpected behavior. Guides through gathering the right details (skill name, prompt used, actual vs expected output, context files present) and generates a properly formatted GitHub issue. Use when users say: 'this skill gave wrong advice', 'report a bug', 'file an issue', 'skill isn't working', 'wrong output', 'skill didn't activate', 'bad recommendation', 'incorrect behavior', or 'something is broken'.

Trigger or resolve a PagerDuty incident for on-call escalation

Designs effective alerting and incident management for production services, covering alert rules, on-call rotations, runbooks, and incident response workflows.

Append-only event log — the probabilistic record of everything that happened in the project. Use whenever something notable happens that the project should remember — work items created/transitioned, decisions recorded, bindings changed, incidents occurred, releases shipped.

Build collaborative forensic incident timelines using Timesketch to ingest, normalize, and analyze multi-source event data for attack chain reconstruction and investigation documentation.

Creates safety alert decks with hazard stripes, tiered cards, and policy code blocks for incident reviews and risk communication.

Manages and analyzes incidents, post-incident reviews, and collaboration workflows in Allma via its REST API, covering incident discovery, timeline tracking, stakeholder communication, and retrospective analysis.