Ciso incident response
Skill sarfaraz-munir/Claude-Code-Cyber-agents/.claude/skills/ciso-incident-response
Hierarchical CISO AI agent swarm for Claude Code — 10 specialist agents covering risk governance, compliance, threat intelligence, vulnerability management, incident response, and AI security (OWASP LLM Top 10 / MITRE ATLAS). Includes MCP tools, Claude Code skills etc.
npx -y skills add sarfaraz-munir/Claude-Code-Cyber-agents --skill ciso-incident-responseAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Generate IR playbooks, tabletop exercise scenarios, and DFIR checklists for ransomware, data breach, insider threat, BEC, and DDoS incidents. Use when responding to or preparing for security incidents.
SKILL.md
2.2 KB, as published. Nobody here has run it
CISO Incident Response
Delegates to ciso-incident-response for IR planning and active incident support.
What This Skill Does
- Retrieves pre-built playbooks for common incident types
- Builds custom playbooks for specific scenarios
- Designs tabletop exercise scenarios
- Produces communication plans and legal consideration checklists
Built-in Playbook Types
| Type | Description |
|---|---|
ransomware | Isolation → backup validation → decryption → comms → LE notification |
data-breach | Scope → legal (72h GDPR) → regulatory → customer comms → remediation |
insider-threat | HR coordination → evidence preservation → access revocation → investigation |
bec-phishing | Email quarantine → credential reset → financial fraud containment |
ddos | Scrubbing → ISP → failover → capacity scaling |
Required Inputs
- Incident type — one of the above or describe a custom scenario
- Severity — critical / high / medium / low
- Affected systems — what's impacted?
- Current status — active incident or preparation/tabletop?
Execution Pattern
Agent(ciso-incident-response, "Generate [type] playbook:
Severity: [severity]
Affected Systems: [list]
Mode: [active-response | tabletop-preparation | plan-review]
Special considerations: [regulatory requirements, business context]
Output: full playbook with steps, communication plan, legal checklist"
)
Output Structure
INCIDENT PLAYBOOK: [Type] — [Severity]
ID: [id] Created: [date]
COMMUNICATION PLAN
[who to notify, when, via what channel]
LEGAL CONSIDERATIONS
[notification obligations, evidence preservation, law enforcement]
RESPONSE STEPS
Phase | Order | Action | Responsible | Timeframe | Tools | Escalation
TABLETOP EXERCISE (if requested)
Objectives: [list]
Injects:
T+0: [initial scenario]
T+[n]: [inject description] Discussion: [questions]
Debrief Guide: [key lessons to extract]