How do I install the Secops Incident Triage Forensics skill?

Run npx skillmds@latest add mchittineni/secops-incident-triage-forensics in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Secops Incident Triage Forensics safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Secops Incident Triage Forensics?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Secops Incident Triage Forensics free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Secops Incident Triage Forensics?

mchittineni (@mchittineni) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Secops Incident Triage Forensics by mchittineni

Name: Secops Incident Triage Forensics
Author: mchittineni

Secops Incident Triage Forensics

Security incident response: compromise triage, cloud instance and credential containment, forensic disk and memory capture with chain of custody, IAM session and key revocation, and SIEM correlation for threat hunting. Use when a host, container or cloud credential is suspected compromised, when a leaked access key found in a public repository has already been used, or when capturing evidence.

mchittineni Updated Sep 17, 2026

File contents

SecOps Security Incident Triage & Compromise Containment

When to Use This Skill

Triggers — load this skill when:

A host, container, or credential is suspected compromised and must be contained
Forensic evidence must be captured without destroying it
Log/SIEM correlation is needed to scope attacker activity

Route elsewhere when:

Availability-only outage with no security dimension -> incident-management-and-postmortem
Detection rule authoring -> container-runtime-security-falco
Post-incident hardening of posture -> cloud-security-posture-cspm-cis

1. Cloud Instance Compromise Triage Flow

[Security Alert: Unauthorized C2 Traffic]
                    |
      1. Isolate Network (Do NOT power off)
                    |
      2. Snapshot Volatile Memory & EBS/Disks
                    |
      3. Revoke IAM Tokens & Rotate Credentials
                    |
      4. Forensic Analysis & Root Cause Determination

2. Emergency Cloud Containment Commands (AWS)

# 1. Attach Quarantine Security Group (Deny All Ingress / Egress)
aws ec2 modify-instance-attribute \
  --instance-id i-0123456789abcdef0 \
  --groups sg-0quarantine-isolate

# 2. Snapshot Root EBS Volume for Forensic Analysis
aws ec2 create-snapshot \
  --volume-id vol-0123456789abcdef0 \
  --description "FORENSIC-SNAPSHOT-INCIDENT-2026-08-19" \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=ChainOfCustody,Value=IncidentResponse}]'

# 3. Revoke active AWS IAM Session / Role Credentials
aws iam put-role-policy \
  --role-name CompromisedServiceRole \
  --policy-name DenyAllExceptIR \
  --policy-document '{
    "Version": "2012-10-17",
    "Statement": [{"Effect": "Deny", "Action": "*", "Resource": "*"}]
  }'

3. Forensics Best Practices

Preserve Volatile Memory: Do not reboot or terminate the instance before dumping RAM if rootkit investigation is required.
Maintain Chain of Custody: Cryptographically hash (sha256sum) all forensic disk images and logs upon creation.
Out-of-Band Communication: Conduct high-severity incident communication in dedicated, access-restricted out-of-band channels.

---name: secops-incident-triage-forensicsdescription: Security incident response: compromise triage, cloud instance and credential containment, forensic disk and memory capture with chain of custody, IAM session and key revocation, and SIEM correlation for threat hunting. Use when a host, container or cloud credential is suspected compromised, when a leaked access key found in a public repository has already been used, or when capturing evidence.---# SecOps Security Incident Triage & Compromise Containment## When to Use This Skill**Triggers — load this skill when:**- A host, container, or credential is suspected compromised and must be contained- Forensic evidence must be captured without destroying it- Log/SIEM correlation is needed to scope attacker activity**Route elsewhere when:**- Availability-only outage with no security dimension -> `incident-management-and-postmortem`- Detection rule authoring -> `container-runtime-security-falco`- Post-incident hardening of posture -> `cloud-security-posture-cspm-cis`## 1. Cloud Instance Compromise Triage Flow```text[Security Alert: Unauthorized C2 Traffic] | 1. Isolate Network (Do NOT power off) | 2. Snapshot Volatile Memory & EBS/Disks | 3. Revoke IAM Tokens & Rotate Credentials | 4. Forensic Analysis & Root Cause Determination```---## 2. Emergency Cloud Containment Commands (AWS)```bash# 1. Attach Quarantine Security Group (Deny All Ingress / Egress)aws ec2 modify-instance-attribute \ --instance-id i-0123456789abcdef0 \ --groups sg-0quarantine-isolate# 2. Snapshot Root EBS Volume for Forensic Analysisaws ec2 create-snapshot \ --volume-id vol-0123456789abcdef0 \ --description "FORENSIC-SNAPSHOT-INCIDENT-2026-08-19" \ --tag-specifications 'ResourceType=snapshot,Tags=[{Key=ChainOfCustody,Value=IncidentResponse}]'# 3. Revoke active AWS IAM Session / Role Credentialsaws iam put-role-policy \ --role-name CompromisedServiceRole \ --policy-name DenyAllExceptIR \ --policy-document '{ "Version": "2012-10-17", "Statement": [{"Effect": "Deny", "Action": "*", "Resource": "*"}] }'```---## 3. Forensics Best Practices- **Preserve Volatile Memory**: Do not reboot or terminate the instance before dumping RAM if rootkit investigation is required.- **Maintain Chain of Custody**: Cryptographically hash (`sha256sum`) all forensic disk images and logs upon creation.- **Out-of-Band Communication**: Conduct high-severity incident communication in dedicated, access-restricted out-of-band channels.

Frequently asked questions