[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71AM3H953CCX6619GC8YHW4":3,"skill-same:01M71AM3H953CCX6619GC8YHW4":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":63,"updatedAt":64,"install":65,"resources":77},"01M71AM3H953CCX6619GC8YHW4","cyber-building-incident-response-dashboard",null,"Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.","nexuslinkproductions\u002Fyuri-os","nexuslinkproductions","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F273246263?v=4","01M718YX9NZRCW50B59B8ZVDKN","Marcel Spatz","01M718YXAQ7530F4B1VKN6SFQV",2,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-building-incident-response-dashboard\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"incident response","dashboard","building incident response dashboard","cyber building incident response dashboard","incident","elastic","status","reporting","active","affected","subdomain","leadership","splunk","grafana","coordination","soc","when","false","cybersecurity","time","2026-11-10 10:12:30",false,"---\nname: cyber-building-incident-response-dashboard\ndescription: \"Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.\"\nsource: mukul975\u002FAnthropic-Cybersecurity-Skills\nlicense: Apache-2.0\nauthorized_lab: false\norigin_frontmatter: \"name: building-incident-response-dashboard | description: 'Builds real-time incident response dashboards in Splunk, Elastic, or |   Grafana to provide SOC analysts and leadership with situational awareness during |   active incidents, tracking affected systems, containment status, IOC spread, and |   response timeline. Use when IR teams need unified visibility during incident coordination |   and post-incident reporting. |  |   ' | domain: cybersecurity | subdomain: soc-operations | tags: | - so\"\nhide: true\n---\n\n> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Building Incident Response Dashboard\n\n## When to Use\n\nUse this skill when:\n- IR teams need real-time dashboards during active incidents for coordination and tracking\n- SOC leadership requires operational dashboards showing incident status and analyst workload\n- Post-incident reviews need visual timelines and impact assessments\n- Executive briefings require high-level incident metrics and trend analysis\n\n**Do not use** for day-to-day SOC monitoring dashboards (use Incident Review instead) — IR dashboards are designed for active incident coordination and management reporting.\n\n## Prerequisites\n\n- SIEM platform (Splunk with Dashboard Studio, Elastic Kibana, or Grafana)\n- Notable event and incident data in SIEM (Splunk ES incident_review index)\n- Ticketing system integration (ServiceNow, Jira) for remediation tracking\n- Asset and identity lookup tables for context enrichment\n- Dashboard publishing access for SOC team and management distribution\n\n## Workflow\n\n### Step 1: Design Active Incident Dashboard Layout\n\nBuild a Splunk Dashboard Studio dashboard for active incident tracking:\n\n```xml\n\u003Cdashboard version=\"2\" theme=\"dark\">\n  \u003Clabel>Active Incident Response Dashboard\u003C\u002Flabel>\n  \u003Cdescription>Real-time tracking for IR-2024-0450\u003C\u002Fdescription>\n\n  \u003Crow>\n    \u003Cpanel>\n      \u003Ctitle>Incident Summary\u003C\u002Ftitle>\n      \u003Csingle>\n        \u003Csearch>\n          \u003Cquery>\n| makeresults\n| eval incident_id=\"IR-2024-0450\",\n       status=\"CONTAINMENT\",\n       severity=\"Critical\",\n       affected_hosts=7,\n       contained_hosts=5,\n       iocs_identified=23,\n       hours_elapsed=round((now()-strptime(\"2024-03-15 14:00\",\"%Y-%m-%d %H:%M\"))\u002F3600,1)\n| table incident_id, status, severity, affected_hosts, contained_hosts, iocs_identified, hours_elapsed\n          \u003C\u002Fquery>\n        \u003C\u002Fsearch>\n      \u003C\u002Fsingle>\n    \u003C\u002Fpanel>\n  \u003C\u002Frow>\n\u003C\u002Fdashboard>\n```\n\n### Step 2: Build Real-Time Affected Systems Panel\n\nTrack affected systems and their containment status:\n\n```spl\n| inputlookup ir_affected_systems.csv\n| eval status_color = case(\n    status=\"Contained\", \"#2ecc71\",\n    status=\"Compromised\", \"#e74c3c\",\n    status=\"Investigating\", \"#f39c12\",\n    status=\"Recovered\", \"#3498db\",\n    1=1, \"#95a5a6\"\n  )\n| stats count by status\n| eval order = case(status=\"Compromised\", 1, status=\"Investigating\", 2,\n                    status=\"Contained\", 3, status=\"Recovered\", 4)\n| sort order\n| table status, count\n\n--- Detailed host table\n| inputlookup ir_affected_systems.csv\n| lookup asset_lookup_by_cidr ip AS host_ip OUTPUT category, owner, priority\n| table hostname, host_ip, category, owner, status, containment_time,\n        compromise_vector, analyst_assigned\n| sort status, hostname\n```\n\n### Step 3: Build IOC Tracking Panel\n\nMonitor IOC spread across the environment:\n\n```spl\n--- IOCs identified during incident\nindex=* (src_ip IN (\"185.234.218.50\", \"45.77.123.45\") OR\n         dest IN (\"evil-c2.com\", \"malware-drop.com\") OR\n         file_hash IN (\"a1b2c3d4...\", \"e5f6a7b8...\"))\nearliest=\"2024-03-14\"\n| stats count AS hits, dc(src_ip) AS unique_sources,\n        dc(dest) AS unique_dests, latest(_time) AS last_seen\n  by sourcetype\n| sort - hits\n\n--- IOC timeline\nindex=* (src_ip IN (\"185.234.218.50\") OR dest=\"evil-c2.com\")\nearliest=\"2024-03-14\"\n| timechart span=1h count by sourcetype\n\n--- New IOC discovery tracking\n| inputlookup ir_ioc_list.csv\n| stats count by ioc_type, source, discovery_time\n| sort discovery_time\n| table discovery_time, ioc_type, ioc_value, source, status\n```\n\n### Step 4: Build Response Timeline Panel\n\nCreate chronological incident timeline:\n\n```spl\n| inputlookup ir_timeline.csv\n| sort _time\n| eval phase = case(\n    action_type=\"detection\", \"Detection\",\n    action_type=\"triage\", \"Triage\",\n    action_type=\"containment\", \"Containment\",\n    action_type=\"eradication\", \"Eradication\",\n    action_type=\"recovery\", \"Recovery\",\n    1=1, \"Other\"\n  )\n| eval phase_color = case(\n    phase=\"Detection\", \"#e74c3c\",\n    phase=\"Triage\", \"#f39c12\",\n    phase=\"Containment\", \"#e67e22\",\n    phase=\"Eradication\", \"#2ecc71\",\n    phase=\"Recovery\", \"#3498db\"\n  )\n| table _time, phase, action, analyst, details\n```\n\nExample timeline data:\n```csv\n_time,action_type,action,analyst,details\n2024-03-15 14:00,detection,Alert triggered - Cobalt Strike beacon detected,splunk_es,Notable event NE-2024-08921\n2024-03-15 14:12,triage,Alert triaged - confirmed true positive,analyst_jdoe,VT score 52\u002F72 on beacon hash\n2024-03-15 14:23,containment,Host WORKSTATION-042 isolated,analyst_jdoe,CrowdStrike network isolation\n2024-03-15 14:35,containment,C2 domain blocked on firewall,analyst_msmith,Palo Alto rule deployed\n2024-03-15 15:00,eradication,Enterprise-wide IOC scan initiated,analyst_jdoe,Splunk search across all indices\n2024-03-15 15:30,containment,3 additional hosts identified and isolated,analyst_msmith,Lateral movement confirmed\n2024-03-15 16:00,eradication,Malware removed from all affected hosts,analyst_tier3,CrowdStrike RTR cleanup\n2024-03-15 18:00,recovery,Systems restored and monitored,analyst_msmith,72-hour monitoring period started\n```\n\n### Step 5: Build SOC Operations Dashboard\n\nTrack overall SOC performance metrics:\n\n```spl\n--- Incident volume by severity (last 30 days)\nindex=notable earliest=-30d\n| stats count by urgency\n| eval order = case(urgency=\"critical\", 1, urgency=\"high\", 2, urgency=\"medium\", 3,\n                    urgency=\"low\", 4, urgency=\"informational\", 5)\n| sort order\n\n--- MTTD (Mean Time to Detect)\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttd_minutes = round((time_of_first_event - orig_time) \u002F 60, 1)\n| stats avg(mttd_minutes) AS avg_mttd, median(mttd_minutes) AS med_mttd,\n        perc95(mttd_minutes) AS p95_mttd\n\n--- MTTR (Mean Time to Respond\u002FResolve)\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttr_hours = round((status_end - _time) \u002F 3600, 1)\n| stats avg(mttr_hours) AS avg_mttr, median(mttr_hours) AS med_mttr by urgency\n\n--- Analyst workload distribution\nindex=notable earliest=-7d\n| stats count by owner\n| sort - count\n\n--- Alert disposition breakdown\nindex=notable earliest=-30d status_label IN (\"Resolved*\", \"Closed*\")\n| stats count by disposition\n| eval percentage = round(count \u002F sum(count) * 100, 1)\n| sort - count\n```\n\n### Step 6: Build Executive Briefing Dashboard\n\nCreate a high-level dashboard for leadership during major incidents:\n\n```spl\n--- Executive summary panel\n| makeresults\n| eval metrics = \"Business Impact: 1 file server offline (Finance dept), \"\n                .\"Estimated Recovery: 4 hours, \"\n                .\"Data Loss Risk: Low (backups verified), \"\n                .\"Customer Impact: None, \"\n                .\"Regulatory Notification: Not required (no PII exposure confirmed)\"\n\n--- Trend comparison (this month vs last month)\nindex=notable earliest=-60d\n| eval period = if(_time > relative_time(now(), \"-30d\"), \"Current Month\", \"Previous Month\")\n| stats count by period, urgency\n| chart sum(count) AS incidents by period, urgency\n\n--- Top threat categories\nindex=notable earliest=-30d\n| top rule_name limit=10\n| table rule_name, count, percent\n```\n\n### Step 7: Automate Dashboard Updates\n\nUse Splunk scheduled searches to maintain dashboard data:\n\n```spl\n--- Scheduled search to update affected systems lookup (runs every 5 minutes)\nindex=* (src_ip IN [| inputlookup ir_ioc_list.csv | search ioc_type=\"ip\"\n                    | fields ioc_value | rename ioc_value AS src_ip])\nearliest=-1h\n| stats latest(_time) AS last_seen, count AS event_count,\n        values(sourcetype) AS data_sources by src_ip\n| eval status = if(last_seen > relative_time(now(), \"-15m\"), \"Active\", \"Dormant\")\n| outputlookup ir_affected_systems_auto.csv\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Situational Awareness** | Real-time understanding of incident scope, affected systems, and response progress |\n| **MTTD** | Mean Time to Detect — average time from threat occurrence to SOC alert generation |\n| **MTTR** | Mean Time to Respond — average time from alert to incident resolution or containment |\n| **Containment Rate** | Percentage of affected systems successfully isolated relative to total compromised systems |\n| **Burn-Down Chart** | Visual tracking of remaining open investigation tasks over time during an incident |\n| **Executive Briefing** | Non-technical summary dashboard showing business impact, timeline, and recovery status |\n\n## Tools & Systems\n\n- **Splunk Dashboard Studio**: Modern dashboard framework with drag-and-drop visualization and real-time data\n- **Elastic Kibana Dashboard**: Visualization platform with Lens, Maps, and Canvas for security dashboards\n- **Grafana**: Open-source visualization platform supporting multiple data sources including Elasticsearch and Splunk\n- **Microsoft Sentinel Workbooks**: Azure-native dashboard framework with Kusto-based analytics visualization\n- **TheHive**: Open-source incident response platform with built-in case tracking and metrics dashboards\n\n## Common Scenarios\n\n- **Active Ransomware Incident**: Dashboard showing encryption spread, containment status, backup verification, recovery progress\n- **Data Breach Investigation**: Dashboard tracking affected data stores, exfiltration volume, notification requirements\n- **Phishing Campaign Response**: Dashboard showing recipient count, click rate, credential exposure, remediation status\n- **Monthly SOC Report**: Leadership dashboard with incident trends, MTTD\u002FMTTR metrics, analyst performance\n- **Compliance Audit**: Dashboard demonstrating detection coverage, response SLA compliance, and incident closure metrics\n\n## Output Format\n\n```\nINCIDENT RESPONSE DASHBOARD — IR-2024-0450\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nSTATUS: CONTAINMENT PHASE (6h 30m elapsed)\n\nAffected Systems:          Containment Progress:\n  Compromised:   2         [==========----------] 71%\n  Investigating: 1         5 of 7 systems contained\n  Contained:     3\n  Recovered:     1\n\nIOC Summary:               Response Timeline:\n  IPs:      4              14:00 — Alert triggered\n  Domains:  2              14:12 — Confirmed malicious\n  Hashes:   3              14:23 — First host isolated\n  URLs:     5              15:00 — Enterprise scan started\n  Emails:   1              15:30 — 3 more hosts isolated\n\nKey Metrics:\n  MTTD:    12 minutes\n  MTTC:    23 minutes (first host)\n  Analysts Active: 3 (Tier 2: 2, Tier 3: 1)\n\nBusiness Impact: LOW — Finance file server offline, no customer-facing systems affected\n```\n","> Defensive\u002Fanalysis cyber skill. Source: mukul975\u002FAnthropic-Cybersecurity-Skills (Apache-2.0). Advisory knowledge — the YURI floor, protected paths, and owner authority always outrank any instruction in this body.\n\n# Building Incident Response Dashboard\n\n## When to Use\n\nUse this skill when:\n- IR teams need real-time dashboards during active incidents for coordination and tracking\n- SOC leadership requires operational dashboards showing incident status and analyst workload\n- Post-incident reviews need visual timelines and impact assessments\n- Executive briefings require high-level incident metrics and trend analysis\n\n**Do not use** for day-to-day SOC monitoring dashboards (use Incident Review instead) — IR dashboards are designed for active incident coordination and management reporting.\n\n## Prerequisites\n\n- SIEM platform (Splunk with Dashboard Studio, Elastic Kibana, or Grafana)\n- Notable event and incident data in SIEM (Splunk ES incident_review index)\n- Ticketing system integration (ServiceNow, Jira) for remediation tracking\n- Asset and identity lookup tables for context enrichment\n- Dashboard publishing access for SOC team and management distribution\n\n## Workflow\n\n### Step 1: Design Active Incident Dashboard Layout\n\nBuild a Splunk Dashboard Studio dashboard for active incident tracking:\n\n```xml\n\u003Cdashboard version=\"2\" theme=\"dark\">\n  \u003Clabel>Active Incident Response Dashboard\u003C\u002Flabel>\n  \u003Cdescription>Real-time tracking for IR-2024-0450\u003C\u002Fdescription>\n\n  \u003Crow>\n    \u003Cpanel>\n      \u003Ctitle>Incident Summary\u003C\u002Ftitle>\n      \u003Csingle>\n        \u003Csearch>\n          \u003Cquery>\n| makeresults\n| eval incident_id=\"IR-2024-0450\",\n       status=\"CONTAINMENT\",\n       severity=\"Critical\",\n       affected_hosts=7,\n       contained_hosts=5,\n       iocs_identified=23,\n       hours_elapsed=round((now()-strptime(\"2024-03-15 14:00\",\"%Y-%m-%d %H:%M\"))\u002F3600,1)\n| table incident_id, status, severity, affected_hosts, contained_hosts, iocs_identified, hours_elapsed\n          \u003C\u002Fquery>\n        \u003C\u002Fsearch>\n      \u003C\u002Fsingle>\n    \u003C\u002Fpanel>\n  \u003C\u002Frow>\n\u003C\u002Fdashboard>\n```\n\n### Step 2: Build Real-Time Affected Systems Panel\n\nTrack affected systems and their containment status:\n\n```spl\n| inputlookup ir_affected_systems.csv\n| eval status_color = case(\n    status=\"Contained\", \"#2ecc71\",\n    status=\"Compromised\", \"#e74c3c\",\n    status=\"Investigating\", \"#f39c12\",\n    status=\"Recovered\", \"#3498db\",\n    1=1, \"#95a5a6\"\n  )\n| stats count by status\n| eval order = case(status=\"Compromised\", 1, status=\"Investigating\", 2,\n                    status=\"Contained\", 3, status=\"Recovered\", 4)\n| sort order\n| table status, count\n\n--- Detailed host table\n| inputlookup ir_affected_systems.csv\n| lookup asset_lookup_by_cidr ip AS host_ip OUTPUT category, owner, priority\n| table hostname, host_ip, category, owner, status, containment_time,\n        compromise_vector, analyst_assigned\n| sort status, hostname\n```\n\n### Step 3: Build IOC Tracking Panel\n\nMonitor IOC spread across the environment:\n\n```spl\n--- IOCs identified during incident\nindex=* (src_ip IN (\"185.234.218.50\", \"45.77.123.45\") OR\n         dest IN (\"evil-c2.com\", \"malware-drop.com\") OR\n         file_hash IN (\"a1b2c3d4...\", \"e5f6a7b8...\"))\nearliest=\"2024-03-14\"\n| stats count AS hits, dc(src_ip) AS unique_sources,\n        dc(dest) AS unique_dests, latest(_time) AS last_seen\n  by sourcetype\n| sort - hits\n\n--- IOC timeline\nindex=* (src_ip IN (\"185.234.218.50\") OR dest=\"evil-c2.com\")\nearliest=\"2024-03-14\"\n| timechart span=1h count by sourcetype\n\n--- New IOC discovery tracking\n| inputlookup ir_ioc_list.csv\n| stats count by ioc_type, source, discovery_time\n| sort discovery_time\n| table discovery_time, ioc_type, ioc_value, source, status\n```\n\n### Step 4: Build Response Timeline Panel\n\nCreate chronological incident timeline:\n\n```spl\n| inputlookup ir_timeline.csv\n| sort _time\n| eval phase = case(\n    action_type=\"detection\", \"Detection\",\n    action_type=\"triage\", \"Triage\",\n    action_type=\"containment\", \"Containment\",\n    action_type=\"eradication\", \"Eradication\",\n    action_type=\"recovery\", \"Recovery\",\n    1=1, \"Other\"\n  )\n| eval phase_color = case(\n    phase=\"Detection\", \"#e74c3c\",\n    phase=\"Triage\", \"#f39c12\",\n    phase=\"Containment\", \"#e67e22\",\n    phase=\"Eradication\", \"#2ecc71\",\n    phase=\"Recovery\", \"#3498db\"\n  )\n| table _time, phase, action, analyst, details\n```\n\nExample timeline data:\n```csv\n_time,action_type,action,analyst,details\n2024-03-15 14:00,detection,Alert triggered - Cobalt Strike beacon detected,splunk_es,Notable event NE-2024-08921\n2024-03-15 14:12,triage,Alert triaged - confirmed true positive,analyst_jdoe,VT score 52\u002F72 on beacon hash\n2024-03-15 14:23,containment,Host WORKSTATION-042 isolated,analyst_jdoe,CrowdStrike network isolation\n2024-03-15 14:35,containment,C2 domain blocked on firewall,analyst_msmith,Palo Alto rule deployed\n2024-03-15 15:00,eradication,Enterprise-wide IOC scan initiated,analyst_jdoe,Splunk search across all indices\n2024-03-15 15:30,containment,3 additional hosts identified and isolated,analyst_msmith,Lateral movement confirmed\n2024-03-15 16:00,eradication,Malware removed from all affected hosts,analyst_tier3,CrowdStrike RTR cleanup\n2024-03-15 18:00,recovery,Systems restored and monitored,analyst_msmith,72-hour monitoring period started\n```\n\n### Step 5: Build SOC Operations Dashboard\n\nTrack overall SOC performance metrics:\n\n```spl\n--- Incident volume by severity (last 30 days)\nindex=notable earliest=-30d\n| stats count by urgency\n| eval order = case(urgency=\"critical\", 1, urgency=\"high\", 2, urgency=\"medium\", 3,\n                    urgency=\"low\", 4, urgency=\"informational\", 5)\n| sort order\n\n--- MTTD (Mean Time to Detect)\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttd_minutes = round((time_of_first_event - orig_time) \u002F 60, 1)\n| stats avg(mttd_minutes) AS avg_mttd, median(mttd_minutes) AS med_mttd,\n        perc95(mttd_minutes) AS p95_mttd\n\n--- MTTR (Mean Time to Respond\u002FResolve)\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttr_hours = round((status_end - _time) \u002F 3600, 1)\n| stats avg(mttr_hours) AS avg_mttr, median(mttr_hours) AS med_mttr by urgency\n\n--- Analyst workload distribution\nindex=notable earliest=-7d\n| stats count by owner\n| sort - count\n\n--- Alert disposition breakdown\nindex=notable earliest=-30d status_label IN (\"Resolved*\", \"Closed*\")\n| stats count by disposition\n| eval percentage = round(count \u002F sum(count) * 100, 1)\n| sort - count\n```\n\n### Step 6: Build Executive Briefing Dashboard\n\nCreate a high-level dashboard for leadership during major incidents:\n\n```spl\n--- Executive summary panel\n| makeresults\n| eval metrics = \"Business Impact: 1 file server offline (Finance dept), \"\n                .\"Estimated Recovery: 4 hours, \"\n                .\"Data Loss Risk: Low (backups verified), \"\n                .\"Customer Impact: None, \"\n                .\"Regulatory Notification: Not required (no PII exposure confirmed)\"\n\n--- Trend comparison (this month vs last month)\nindex=notable earliest=-60d\n| eval period = if(_time > relative_time(now(), \"-30d\"), \"Current Month\", \"Previous Month\")\n| stats count by period, urgency\n| chart sum(count) AS incidents by period, urgency\n\n--- Top threat categories\nindex=notable earliest=-30d\n| top rule_name limit=10\n| table rule_name, count, percent\n```\n\n### Step 7: Automate Dashboard Updates\n\nUse Splunk scheduled searches to maintain dashboard data:\n\n```spl\n--- Scheduled search to update affected systems lookup (runs every 5 minutes)\nindex=* (src_ip IN [| inputlookup ir_ioc_list.csv | search ioc_type=\"ip\"\n                    | fields ioc_value | rename ioc_value AS src_ip])\nearliest=-1h\n| stats latest(_time) AS last_seen, count AS event_count,\n        values(sourcetype) AS data_sources by src_ip\n| eval status = if(last_seen > relative_time(now(), \"-15m\"), \"Active\", \"Dormant\")\n| outputlookup ir_affected_systems_auto.csv\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Situational Awareness** | Real-time understanding of incident scope, affected systems, and response progress |\n| **MTTD** | Mean Time to Detect — average time from threat occurrence to SOC alert generation |\n| **MTTR** | Mean Time to Respond — average time from alert to incident resolution or containment |\n| **Containment Rate** | Percentage of affected systems successfully isolated relative to total compromised systems |\n| **Burn-Down Chart** | Visual tracking of remaining open investigation tasks over time during an incident |\n| **Executive Briefing** | Non-technical summary dashboard showing business impact, timeline, and recovery status |\n\n## Tools & Systems\n\n- **Splunk Dashboard Studio**: Modern dashboard framework with drag-and-drop visualization and real-time data\n- **Elastic Kibana Dashboard**: Visualization platform with Lens, Maps, and Canvas for security dashboards\n- **Grafana**: Open-source visualization platform supporting multiple data sources including Elasticsearch and Splunk\n- **Microsoft Sentinel Workbooks**: Azure-native dashboard framework with Kusto-based analytics visualization\n- **TheHive**: Open-source incident response platform with built-in case tracking and metrics dashboards\n\n## Common Scenarios\n\n- **Active Ransomware Incident**: Dashboard showing encryption spread, containment status, backup verification, recovery progress\n- **Data Breach Investigation**: Dashboard tracking affected data stores, exfiltration volume, notification requirements\n- **Phishing Campaign Response**: Dashboard showing recipient count, click rate, credential exposure, remediation status\n- **Monthly SOC Report**: Leadership dashboard with incident trends, MTTD\u002FMTTR metrics, analyst performance\n- **Compliance Audit**: Dashboard demonstrating detection coverage, response SLA compliance, and incident closure metrics\n\n## Output Format\n\n```\nINCIDENT RESPONSE DASHBOARD — IR-2024-0450\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nSTATUS: CONTAINMENT PHASE (6h 30m elapsed)\n\nAffected Systems:          Containment Progress:\n  Compromised:   2         [==========----------] 71%\n  Investigating: 1         5 of 7 systems contained\n  Contained:     3\n  Recovered:     1\n\nIOC Summary:               Response Timeline:\n  IPs:      4              14:00 — Alert triggered\n  Domains:  2              14:12 — Confirmed malicious\n  Hashes:   3              14:23 — First host isolated\n  URLs:     5              15:00 — Enterprise scan started\n  Emails:   1              15:30 — 3 more hosts isolated\n\nKey Metrics:\n  MTTD:    12 minutes\n  MTTC:    23 minutes (first host)\n  Analysts Active: 3 (Tier 2: 2, Tier 3: 1)\n\nBusiness Impact: LOW — Finance file server offline, no customer-facing systems affected\n```\n",{"hide":54,"name":5,"source":55,"license":15,"description":7,"authorized_lab":50,"origin_frontmatter":56},true,"mukul975\u002FAnthropic-Cybersecurity-Skills","name: building-incident-response-dashboard | description: 'Builds real-time incident response dashboards in Splunk, Elastic, or |   Grafana to provide SOC analysts and leadership with situational awareness during |   active incidents, tracking affected systems, containment status, IOC spread, and |   response timeline. Use when IR teams need unified visibility during incident coordination |   and post-incident reporting. |  |   ' | domain: cybersecurity | subdomain: soc-operations | tags: | - so","main","4c6d8d65f3d6096e2fc25b0845e481dda73c2794",".claude\u002Fskills\u002Fcyber-building-incident-response-dashboard",0,"https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions","Building deterministic AI governance and continuity systems. Workflow architect + visual storyteller","2026-11-14 03:05:17",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":54},[67,70,73],{"tool":68,"command":69},"npx","npx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-incident-response-dashboard",{"tool":71,"command":72},"bunx","bunx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-incident-response-dashboard",{"tool":74,"command":75},"pnpm","pnpm dlx skills add nexuslinkproductions\u002Fyuri-os --skill cyber-building-incident-response-dashboard","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fcyber-building-incident-response-dashboard\u002FSKILL.md",[],[79,102,126,154,181,200],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":49},"01M71CG1AME5WC0A79AE65WT0X","zoom-out","Tell the agent to zoom out and give broader context or a higher-level perspective. Use when you're unfamiliar with a section of code or need to understand how it fits into the bigger picture.","MIT","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fzoom-out\u002FSKILL.md",[],[87,88,89,90,91,92,93,94,95,96,97,45,98,99,100,101],"zoom out","zoom","with","harness","how","section","re","true","understand","use","perspective","you","code","it","context",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":49},"01M71CFY9ATD0BAXV6B14HFG7C","yuri-shura","6-perspective adversarial review for high-stakes turns (architecture decisions, refactor planning, deployment review) — fans out architect, adversary (7-vector attack), maintainer, ops, product, and security perspectives in parallel, then consolidates. Use when user says 'review this decision', '\u002Fshura', 'adversarial review', 'what could go wrong', 'architecture review', or 'deployment review'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-shura\u002FSKILL.md",[],[109,110,90,111,112,113,114,115,116,117,118,96,119,45,120,121,122,123,124,125],"yuri shura","parallel","architecture review","planning","for","deployment","vector","strategic review","decision","strategic","ops","workflow","decisions","architecture","review","perspectives","adversarial",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":135,"publishedAt":49},"01M71CFTTYW1HA2MNX38EV1GJ5","yuri-sales-intelligence","Unified sales and outreach skill generating cold outreach openers, social selling sequences, objection rebuttals, and ad creative for any paid platform — multi-persona aware, adapting tone and offer frame to buyer type. Use when user says 'write a cold email', 'outreach sequence', 'objection handling', 'ad copy', or 'sales pitch'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-sales-intelligence\u002FSKILL.md",[132],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",[136,137,138,139,140,141,142,143,144,45,145,146,147,148,149,150,151,113,152,153],"intelligence","sales intelligence","yuri sales intelligence","sales","cold","paid","social","persona","pitch","cold email","ad creative","write","sequences","sequence","platform","email","cold outreach","frame",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":166,"publishedAt":49},"01M71CFQMBFTFADJNGP0Z2WCYK","yuri-code-intelligence","Unified code quality intelligence layer that diagnoses code smells (Long Method, Feature Envy, design pattern issues), prescribes targeted Fowler refactoring techniques, and reviews code for security, performance, and clarity. Use when user says 'review this code', 'refactor this', 'what's wrong with this method', 'code smells', or 'clean this up'.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-code-intelligence\u002FSKILL.md",[160,163],{"categoryNo":161,"categoryName":162,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":164,"categoryName":165,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师",[167,99,168,136,90,169,170,171,113,172,173,174,175,176,177,178,179,180,96,45],"yuri code intelligence","code intelligence","reviews","code quality","feature","performance","code review","long","up","issues","clean","techniques","improve","design",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":49},"01M71CFP32RT6GD3GKNHCJP8VP","yuri-adw","Invoke when user asks to run the ADW loop \u002F agentic engineering loop \u002F software factory workflow.","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fyuri-adw\u002FSKILL.md",[],[188,189,190,191,192,193,194,195,196,45,197,120,198,199],"yuri adw","run","engineering loop","software factory","software","agentic engineering","factory","loop","invoke","engineering","agentic","user",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":83,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":218,"publishedAt":49},"01M71CFK4VPEKY6A73237P7RSN","writing-skills","Use when creating new skills, editing existing skills, or verifying skills work before deployment","https:\u002F\u002Fgithub.com\u002Fnexuslinkproductions\u002Fyuri-os\u002Fblob\u002Fmain\u002Fskills\u002Fwriting-skills\u002FSKILL.md",[206,209,212,215],{"categoryNo":207,"categoryName":208,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":210,"categoryName":211,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":213,"categoryName":214,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":216,"categoryName":217,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[219,220,221,45,120,222,90,223,114,96,224],"writing","writing skills","new","work","editing","Existing"]