domains / families / security / incident-response

incident-response

authentic

Handle security incidents with IR playbooks and procedures. Implement detection, containment, eradication, and recovery processes. Use when responding to security events or building incident response capabilities.

When to use

• Responding to an active security incident (breach, malware, unauthorized access)
• Building incident response playbooks and runbooks
• Conducting IR tabletop exercises and drills
• Setting up evidence collection and forensic capabilities
• Establishing communication protocols for security events
• Performing post-incident reviews and process improvements

Skill page

Source