# Edr Triage

> bb-edr: Triage Skill

- Skill: `gabrielmoreira/edr-triage` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/edr-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/edr-triage/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/gabrielmoreira/edr-triage

---

# bb-edr: Triage Skill

Use this skill to turn clawdstrike audit logs into an incident report and a minimal response plan.

## Inputs

- `.hush/audit.jsonl` (JSONL) — clawdstrike audit events (allowed/denied, guard, reason).
- `policy.yaml` — the active security policy.

## Task

1. Read and summarize the last ~50 audit events.
2. Focus on **denied** events first:
   - Group by `guard` (e.g., `forbidden_path`, `egress`, `patch_integrity`)
   - Identify likely intent (misconfiguration vs. suspicious)
3. Produce a short incident report:
   - What happened (timeline + key indicators)
   - Impact assessment (what was attempted, what was blocked)
   - Recommended response (least-privilege)
4. If you propose any response action (writing files, changing config), **use `policy_check` first** and keep changes scoped to this project directory.

## Output

- Write `./reports/incident.md` containing the final report.

## Notes (important)

- clawdstrike enforces at the **tool boundary**. It is not an OS sandbox.
- If an operation is denied, treat it as a strong indicator of suspicious behavior or incorrect policy assumptions.