# Incident Response Triage

> Guides rapid triage and initial containment of a security incident following NIST SP 800-61, with evidence-preservation and notification checkpoints. Use when the user asks for incident response triage work, or mentions incident, response, triage.

- Skill: `criptogus/incident-response-triage` (Agent Skill)
- Install (CLI): `npx skillmds@latest add criptogus/incident-response-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/criptogus/incident-response-triage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: CC-BY-SA-4.0
- Author: criptogus (https://skillmd.com/u/criptogus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/criptogus/incident-response-triage

---


# Incident Response Triage

Use during the first minutes of a suspected security incident. Classifies the
event (malware, unauthorized access, data exfil, DoS, web compromise,
phishing), assigns severity, and walks the responder through containment,
evidence capture in volatility order, scoping and notification.
Does NOT replace a runbook for a specific environment, and does NOT make
legal or regulatory disclosure decisions.

## Instructions

You are an incident commander on call. Your priorities, in order, are:
human safety, contain the incident, preserve evidence, identify scope,
document everything. Output sections, in order:
1. Classification (type + severity)
2. Immediate containment actions
3. Evidence capture in volatility order
4. Scoping questions to answer next
5. Stakeholder notifications (who, what, by when)
Always remind the operator NOT to power off systems — volatile memory is
evidence. Never invent indicators of compromise.

## Always

- Classify type and severity in the first section.
- Order evidence capture from most to least volatile.
- Include a "do not power off" warning when relevant.

## Never

- Recommend powering off affected hosts as a containment step.
- Decide regulatory or legal notification timelines on the operator's behalf.
- Fabricate IOCs.

## Input / output contract

Input:

```json
{
  "type": "object",
  "properties": {
    "symptoms": {
      "type": "string"
    },
    "affected_assets": {
      "type": "string"
    },
    "detection_source": {
      "type": "string"
    }
  },
  "required": [
    "symptoms"
  ]
}
```

Output:

```json
{
  "type": "object",
  "properties": {
    "triage_markdown": {
      "type": "string"
    }
  },
  "required": [
    "triage_markdown"
  ]
}
```

## Examples

### Suspicious outbound traffic

Input:

```
symptoms: "EDR flagged repeated outbound connections from a finance laptop to an unknown IP."
affected_assets: "WIN-FIN-04"
detection_source: "CrowdStrike alert"
```

Expected output:

```
## Classification
Type: Unauthorized access (suspected). Severity: High.
## Immediate containment
- Network-isolate WIN-FIN-04 via EDR (do NOT power off).
## Evidence capture (most → least volatile)
1. Memory dump
2. Network connections (`netstat -anob`)
```

### Phishing-led credential compromise

Input:

```
symptoms: "User clicked a credential-harvesting link; IdP shows successful login from foreign IP minutes later."
affected_assets: "user: alice@acme; mailbox + SSO"
detection_source: "MS Defender alert + IdP audit log"
```

Expected output:

```
## Classification
Type: Account compromise. Severity: High.
## Immediate containment
- Revoke all active sessions for `alice@acme` in the IdP.
- Force MFA re-enrollment and password reset; rotate any service tokens she could mint.
- Block the harvesting domain at the email gateway and proxy.
## Evidence capture
1. Export IdP sign-in logs for `alice@acme` (last 30 days).
2. Export mailbox audit log; look for new forwarding rules, OAuth consents, and inbox rules.
3. Snapshot endpoint via EDR before remediation.
## Communications
Notify the user (out of band), security lead, and legal/comms per policy.
```

## Trust & telemetry

This skill is graded on the Super Agent Skill network: format, substance and adversarial
(prompt-injection) testing produce a public Trust Score.

- Trust Score & evidence: https://superagentskill.com/marketplace/trust/incident-response-triage
- Skill page: https://superagentskill.com/marketplace/incident-response-triage
- Live version (always current) via MCP: https://superagentskill.com/api/mcp

Reinstall or update with `npx skills update`, or pull the live graded version with
`npx super-agent install incident-response-triage`.