Responding To Security Incidents
This skill empowers Claude to guide you through the security incident response process, ensuring a structured and effective approach to handling security breaches and attacks. It helps you classify incidents, develop response strategies, gather crucial evidence, and implement remediation steps to minimize damage and prevent future occurrences.
Install
/plugin marketplace add jeremylongshore/claude-code-plugins-plus-skills
/plugin install security-incident-responder@claude-code-plugins-plusRun these inside Claude Code. The skill comes with its plugin.
What this skill does
Assists with security incident response, investigation, and remediation. This skill is triggered when the user requests help with incident response, mentions specific incident types (e.g., data breach, ransomware, DDoS), or uses terms like "incident response plan", "containment", "eradication", or "post-incident activity". It guides the user through the incident response lifecycle, from preparation to post-incident analysis. It is useful for classifying incidents, creating response playbooks, collecting evidence, constructing timelines, and generating remediation steps. Use this skill when nee
Trigger phrases
Claude loads this skill automatically when you say things like:
How it works
- Playbook Generation: Creates a tailored response playbook based on the incident classification, outlining the necessary steps for containment, eradication, and recovery.
- Evidence Gathering: Provides guidance on collecting relevant logs, network data, and forensic evidence to support the investigation.
- Remediation Planning: Develops a detailed plan for remediating the vulnerabilities exploited during the incident and restoring affected systems.
When to use it
- Respond to a suspected security breach or attack.
- Develop an incident response plan.
- Investigate a security incident and gather evidence.
- Remediate vulnerabilities exploited during a security incident.
- Generate a post-incident report and lessons learned.
Best practices
- Evidence Preservation: Carefully preserve all evidence to support the investigation and potential legal action.
- Communication: Maintain clear and consistent communication with stakeholders throughout the incident response process.
Details
- Skill name
responding-to-security-incidents- Plugin
- security-incident-responder
FAQ
What does the Responding To Security Incidents skill do?
Assists with security incident response, investigation, and remediation. This skill is triggered when the user requests help with incident response, mentions specific incident types (e.g., data breach, ransomware, DDoS), or uses terms like "incident response plan", "containment", "eradication", or "post-incident activity". It guides the user through the incident response lifecycle, from preparation to post-incident analysis. It is useful for classifying incidents, creating response playbooks, collecting evidence, constructing timelines, and generating remediation steps. Use this skill when nee
How do I install the Responding To Security Incidents skill?
Claude Code plugin: /plugin marketplace add jeremylongshore/claude-code-plugins-plus-skills then /plugin install security-incident-responder@claude-code-plugins-plus. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Related skills
000 Jeremy Content Consistency Validator
jeremylongshore/claude-code-plugins-plus-skills
Validates messaging consistency across website, GitHub repositories, and local documentation. Generates comprehensive read-only discrepancy reports showing where messaging conflicts or inconsistencies exist. Activates when user mentions "consistency check", "validate documentation", "check for mixed messaging", "audit content consistency", or before updating internal paperwork.
001 Jeremy Taskwarrior Integration
jeremylongshore/claude-code-plugins-plus-skills
Enforces complete Taskwarrior integration protocol for ALL coding tasks. Activates automatically when user mentions "taskwarrior", "task warrior", "tw", or discusses task management. Decomposes all coding work into properly tracked Taskwarrior tasks with full lifecycle: task add → task start → implementation → task done. Integrates with Timewarrior for automatic time tracking.
Adapting Transfer Learning Models
jeremylongshore/claude-code-plugins-plus-skills
This skill automates the adaptation of pre-trained machine learning models using transfer learning techniques. It is triggered when the user requests assistance with fine-tuning a model, adapting a pre-trained model to a new dataset, or performing transfer learning. It analyzes the user's requirements, generates code for adapting the model, includes data validation and error handling, provides performance metrics, and saves artifacts with documentation. Use this skill when you need to leverage existing models for new tasks or datasets, optimizing for performance and efficiency.
Scanning Container Security
jeremylongshore/claude-code-plugins-plus-skills
This skill enables Claude to scan container images and running containers for vulnerabilities using tools like Trivy and Snyk. It identifies potential security risks in container environments. Use this skill when the user requests a security assessment of a container image, asks to identify vulnerabilities in a container, or wants to improve the security posture of their containerized applications. Trigger terms include "scan container," "container security," "vulnerability assessment," "Trivy scan," or "Snyk scan.
Plugin Auditor
jeremylongshore/claude-code-plugins-plus-skills
Automatically audits Claude Code plugins for security vulnerabilities, best practices, CLAUDE.md compliance, and quality standards when user mentions audit plugin, security review, or best practices check. Specific to claude-code-plugins repository standards. allowed-tools: Read, Grep, Bash
Scanning Database Security
jeremylongshore/claude-code-plugins-plus-skills
This skill enables Claude to perform comprehensive database security scans using the database-security-scanner plugin. It is triggered when the user requests a security assessment of a database, including identifying vulnerabilities like weak passwords, SQL injection risks, and insecure configurations. The skill leverages OWASP guidelines to ensure thorough coverage and provides remediation suggestions. Use this skill when the user asks to "scan database security", "check database for vulnerabilities", "perform OWASP compliance check on database", or "assess database security posture". The plu
Browse the most popular Claude skills, all security skills, or write your own with the skills generator.