[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73GENPZPNYKCNY36MXDXBZC":3,"skill-same:01M73GENPZPNYKCNY36MXDXBZC":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":51,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M73GENPZPNYKCNY36MXDXBZC","triaging-security-incident-with-ir-playbook",null,"Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: triaging-security-incident-with-ir-playbook\ndescription: Classify and prioritize security incidents using structured IR playbooks\n  to determine severity, assign response teams, and initiate appropriate response\n  procedures.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- incident-response\n- triage\n- playbook\n- severity-classification\n- soc\nmitre_attack:\n- T1486\n- T1490\n- T1070\n- T1078\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\n---\n\n# Triaging Security Incidents with IR Playbooks\n\n## When to Use\n- New security alert received from SIEM, EDR, or other detection sources\n- SOC analyst needs to determine if an alert is a true positive requiring response\n- Incident needs severity classification and team assignment\n- Multiple concurrent incidents require prioritization\n- Automated triage rules need validation or tuning\n\n## Prerequisites\n- SIEM platform with alert correlation (Splunk, Elastic, QRadar, Sentinel)\n- Incident response playbook library (by incident type)\n- Severity classification matrix approved by CISO\n- On-call rotation and escalation procedures\n- Ticketing system for incident tracking (ServiceNow, Jira, TheHive)\n- Threat intelligence feeds for IOC enrichment\n\n## Workflow\n\n### Step 1: Receive and Acknowledge Alert\n```bash\n# Query Splunk for new critical\u002Fhigh severity alerts\nindex=notable status=new severity IN (\"critical\",\"high\")\n| table _time, rule_name, src, dest, severity, description\n| sort -_time\n\n# Query TheHive for new cases\ncurl -s -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fquery?name=list-alerts\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":[{\"_name\":\"listAlert\"},{\"_name\":\"filter\",\"_field\":\"status\",\"_value\":\"New\"}]}'\n\n# Acknowledge alert in SIEM to prevent duplicate triage\ncurl -X POST \"https:\u002F\u002Fsplunk.local:8089\u002Fservices\u002Fnotable_update\" \\\n  -H \"Authorization: Bearer $SPLUNK_TOKEN\" \\\n  -d \"ruleUIDs=$RULE_UID&status=1&comment=Triage+initiated+by+analyst\"\n```\n\n### Step 2: Enrich Alert Data\n```bash\n# Enrich source IP with VirusTotal\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fip_addresses\u002F$SRC_IP\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Check IP reputation with AbuseIPDB\ncurl -s \"https:\u002F\u002Fapi.abuseipdb.com\u002Fapi\u002Fv2\u002Fcheck?ipAddress=$SRC_IP&maxAgeInDays=90\" \\\n  -H \"Key: $ABUSEIPDB_KEY\" -H \"Accept: application\u002Fjson\" | jq '.data'\n\n# Enrich file hash with threat intelligence\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$FILE_HASH\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Query internal asset database for affected systems\ncurl -s \"https:\u002F\u002Fcmdb.local\u002Fapi\u002Fassets?ip=$DEST_IP\" \\\n  -H \"Authorization: Bearer $CMDB_TOKEN\" | jq '.asset_criticality, .owner, .environment'\n```\n\n### Step 3: Classify Incident Type\n```bash\n# Map alert to incident category using playbook lookup\n# Categories: Malware, Phishing, Unauthorized Access, Data Exfiltration,\n# DoS\u002FDDoS, Insider Threat, Ransomware, Account Compromise, Web Attack\n\n# Check if alert matches known playbook trigger conditions\ngrep -i \"$ALERT_SIGNATURE\" \u002Fopt\u002Fir\u002Fplaybooks\u002Ftrigger_conditions.yaml\n\n# Determine incident type from MITRE ATT&CK technique\ncurl -s \"https:\u002F\u002Fattack.mitre.org\u002Fapi\u002Ftechniques\u002F$TECHNIQUE_ID\" | jq '.name, .tactic'\n```\n\n### Step 4: Assign Severity Level\n```bash\n# Severity matrix factors:\n# 1. Asset criticality (Critical\u002FHigh\u002FMedium\u002FLow)\n# 2. Data sensitivity (PII\u002FPHI\u002FPCI\u002FConfidential\u002FPublic)\n# 3. Number of affected systems\n# 4. Active vs historical threat\n# 5. Confirmed vs suspected compromise\n\n# Automated severity calculation\npython3 -c \"\nseverity_score = 0\n# Asset criticality: Critical=4, High=3, Medium=2, Low=1\nseverity_score += 4  # Critical server\n# Data sensitivity: PII\u002FPHI=4, PCI=3, Confidential=2, Public=1\nseverity_score += 3  # PCI data\n# Scope: Enterprise=4, Department=3, Single system=2, Single user=1\nseverity_score += 2  # Single system\n# Threat status: Active=4, Recent=3, Historical=2, Potential=1\nseverity_score += 4  # Active threat\n\nif severity_score >= 12: print('CRITICAL - P1')\nelif severity_score >= 9: print('HIGH - P2')\nelif severity_score >= 6: print('MEDIUM - P3')\nelse: print('LOW - P4')\nprint(f'Score: {severity_score}\u002F16')\n\"\n```\n\n### Step 5: Select and Initiate Playbook\n```bash\n# Load appropriate playbook based on incident type\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Fransomware_playbook.yaml\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Fphishing_playbook.yaml\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Funauthorized_access_playbook.yaml\n\n# Create incident ticket in TheHive\ncurl -X POST \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"title\": \"IR-2024-XXX: [Incident Type] - [Brief Description]\",\n    \"description\": \"Triage summary and initial findings\",\n    \"severity\": 3,\n    \"tlp\": 2,\n    \"pap\": 2,\n    \"tags\": [\"ransomware\", \"triage-complete\"],\n    \"customFields\": {\n      \"playbook\": {\"string\": \"ransomware_v2\"},\n      \"affected_systems\": {\"integer\": 5}\n    }\n  }'\n```\n\n### Step 6: Assign Response Team\n```bash\n# Check on-call schedule\ncurl -s \"https:\u002F\u002Fpagerduty.com\u002Fapi\u002Fv2\u002Foncalls?schedule_ids[]=$SCHEDULE_ID\" \\\n  -H \"Authorization: Token token=$PD_TOKEN\" | jq '.oncalls[].user.summary'\n\n# Page incident responders based on severity\n# P1\u002FCritical: Page IR lead + senior analysts + CISO\n# P2\u002FHigh: Page IR lead + available analysts\n# P3\u002FMedium: Assign to next available analyst\n# P4\u002FLow: Queue for business hours processing\n\ncurl -X POST \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"routing_key\": \"'$PD_ROUTING_KEY'\",\n    \"event_action\": \"trigger\",\n    \"payload\": {\n      \"summary\": \"P1 Security Incident: Ransomware detected on PROD-DB-01\",\n      \"severity\": \"critical\",\n      \"source\": \"SIEM-Splunk\",\n      \"custom_details\": {\"incident_id\": \"IR-2024-042\", \"playbook\": \"ransomware_v2\"}\n    }\n  }'\n```\n\n### Step 7: Document Triage Decision and Hand Off\n```bash\n# Update incident ticket with triage summary\ncurl -X PATCH \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\u002F$CASE_ID\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"status\": \"InProgress\",\n    \"customFields\": {\n      \"triage_analyst\": {\"string\": \"analyst_name\"},\n      \"triage_time\": {\"date\": '$(date +%s000)'},\n      \"severity_justification\": {\"string\": \"Critical asset + active threat + PCI data\"}\n    }\n  }'\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| True Positive | Alert correctly identifying a real security incident |\n| False Positive | Alert incorrectly flagging benign activity as malicious |\n| Severity Classification | Ranking incident priority based on impact and urgency |\n| Playbook Selection | Choosing the appropriate response procedure based on incident type |\n| IOC Enrichment | Adding context to indicators from threat intelligence sources |\n| Escalation Threshold | Criteria triggering escalation to higher severity or management |\n| Triage SLA | Time target for initial assessment (typically 15-30 min for critical) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Splunk\u002FElastic\u002FQRadar | SIEM alert correlation and querying |\n| TheHive\u002FSIRP | Incident case management and playbook tracking |\n| VirusTotal\u002FAbuseIPDB | IOC reputation and enrichment |\n| PagerDuty\u002FOpsGenie | On-call management and alerting |\n| MITRE ATT&CK | Technique classification and mapping |\n| Cortex XSOAR | SOAR platform for automated triage workflows |\n\n## Common Scenarios\n\n1. **Brute Force Alert**: Multiple failed logins from single IP. Enrich IP reputation, check geo-location, verify if account was compromised, assign P3 if unsuccessful.\n2. **Malware Detection on Endpoint**: AV\u002FEDR quarantined malware. Verify quarantine success, check for lateral movement, assign P2 if persistence detected.\n3. **Suspicious Outbound Traffic**: Large data transfer to unknown external IP. Check if known cloud service, verify data classification, assign P1 if exfiltration confirmed.\n4. **Phishing Email Reported**: User reports suspicious email. Extract IOCs, check if others received it, assign P2 if credentials were entered.\n5. **Privilege Escalation**: User gained admin rights unexpectedly. Verify if authorized change, check for exploitation, assign P1 if unauthorized.\n\n## Output Format\n- Triage decision document with severity justification\n- Incident ticket with assigned playbook and team\n- IOC enrichment summary attached to case\n- Escalation notification to appropriate stakeholders\n- Initial timeline of events from alert data\n","# Triaging Security Incidents with IR Playbooks\n\n## When to Use\n- New security alert received from SIEM, EDR, or other detection sources\n- SOC analyst needs to determine if an alert is a true positive requiring response\n- Incident needs severity classification and team assignment\n- Multiple concurrent incidents require prioritization\n- Automated triage rules need validation or tuning\n\n## Prerequisites\n- SIEM platform with alert correlation (Splunk, Elastic, QRadar, Sentinel)\n- Incident response playbook library (by incident type)\n- Severity classification matrix approved by CISO\n- On-call rotation and escalation procedures\n- Ticketing system for incident tracking (ServiceNow, Jira, TheHive)\n- Threat intelligence feeds for IOC enrichment\n\n## Workflow\n\n### Step 1: Receive and Acknowledge Alert\n```bash\n# Query Splunk for new critical\u002Fhigh severity alerts\nindex=notable status=new severity IN (\"critical\",\"high\")\n| table _time, rule_name, src, dest, severity, description\n| sort -_time\n\n# Query TheHive for new cases\ncurl -s -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fquery?name=list-alerts\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\"query\":[{\"_name\":\"listAlert\"},{\"_name\":\"filter\",\"_field\":\"status\",\"_value\":\"New\"}]}'\n\n# Acknowledge alert in SIEM to prevent duplicate triage\ncurl -X POST \"https:\u002F\u002Fsplunk.local:8089\u002Fservices\u002Fnotable_update\" \\\n  -H \"Authorization: Bearer $SPLUNK_TOKEN\" \\\n  -d \"ruleUIDs=$RULE_UID&status=1&comment=Triage+initiated+by+analyst\"\n```\n\n### Step 2: Enrich Alert Data\n```bash\n# Enrich source IP with VirusTotal\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Fip_addresses\u002F$SRC_IP\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Check IP reputation with AbuseIPDB\ncurl -s \"https:\u002F\u002Fapi.abuseipdb.com\u002Fapi\u002Fv2\u002Fcheck?ipAddress=$SRC_IP&maxAgeInDays=90\" \\\n  -H \"Key: $ABUSEIPDB_KEY\" -H \"Accept: application\u002Fjson\" | jq '.data'\n\n# Enrich file hash with threat intelligence\ncurl -s \"https:\u002F\u002Fwww.virustotal.com\u002Fapi\u002Fv3\u002Ffiles\u002F$FILE_HASH\" \\\n  -H \"x-apikey: $VT_API_KEY\" | jq '.data.attributes.last_analysis_stats'\n\n# Query internal asset database for affected systems\ncurl -s \"https:\u002F\u002Fcmdb.local\u002Fapi\u002Fassets?ip=$DEST_IP\" \\\n  -H \"Authorization: Bearer $CMDB_TOKEN\" | jq '.asset_criticality, .owner, .environment'\n```\n\n### Step 3: Classify Incident Type\n```bash\n# Map alert to incident category using playbook lookup\n# Categories: Malware, Phishing, Unauthorized Access, Data Exfiltration,\n# DoS\u002FDDoS, Insider Threat, Ransomware, Account Compromise, Web Attack\n\n# Check if alert matches known playbook trigger conditions\ngrep -i \"$ALERT_SIGNATURE\" \u002Fopt\u002Fir\u002Fplaybooks\u002Ftrigger_conditions.yaml\n\n# Determine incident type from MITRE ATT&CK technique\ncurl -s \"https:\u002F\u002Fattack.mitre.org\u002Fapi\u002Ftechniques\u002F$TECHNIQUE_ID\" | jq '.name, .tactic'\n```\n\n### Step 4: Assign Severity Level\n```bash\n# Severity matrix factors:\n# 1. Asset criticality (Critical\u002FHigh\u002FMedium\u002FLow)\n# 2. Data sensitivity (PII\u002FPHI\u002FPCI\u002FConfidential\u002FPublic)\n# 3. Number of affected systems\n# 4. Active vs historical threat\n# 5. Confirmed vs suspected compromise\n\n# Automated severity calculation\npython3 -c \"\nseverity_score = 0\n# Asset criticality: Critical=4, High=3, Medium=2, Low=1\nseverity_score += 4  # Critical server\n# Data sensitivity: PII\u002FPHI=4, PCI=3, Confidential=2, Public=1\nseverity_score += 3  # PCI data\n# Scope: Enterprise=4, Department=3, Single system=2, Single user=1\nseverity_score += 2  # Single system\n# Threat status: Active=4, Recent=3, Historical=2, Potential=1\nseverity_score += 4  # Active threat\n\nif severity_score >= 12: print('CRITICAL - P1')\nelif severity_score >= 9: print('HIGH - P2')\nelif severity_score >= 6: print('MEDIUM - P3')\nelse: print('LOW - P4')\nprint(f'Score: {severity_score}\u002F16')\n\"\n```\n\n### Step 5: Select and Initiate Playbook\n```bash\n# Load appropriate playbook based on incident type\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Fransomware_playbook.yaml\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Fphishing_playbook.yaml\ncat \u002Fopt\u002Fir\u002Fplaybooks\u002Funauthorized_access_playbook.yaml\n\n# Create incident ticket in TheHive\ncurl -X POST \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"title\": \"IR-2024-XXX: [Incident Type] - [Brief Description]\",\n    \"description\": \"Triage summary and initial findings\",\n    \"severity\": 3,\n    \"tlp\": 2,\n    \"pap\": 2,\n    \"tags\": [\"ransomware\", \"triage-complete\"],\n    \"customFields\": {\n      \"playbook\": {\"string\": \"ransomware_v2\"},\n      \"affected_systems\": {\"integer\": 5}\n    }\n  }'\n```\n\n### Step 6: Assign Response Team\n```bash\n# Check on-call schedule\ncurl -s \"https:\u002F\u002Fpagerduty.com\u002Fapi\u002Fv2\u002Foncalls?schedule_ids[]=$SCHEDULE_ID\" \\\n  -H \"Authorization: Token token=$PD_TOKEN\" | jq '.oncalls[].user.summary'\n\n# Page incident responders based on severity\n# P1\u002FCritical: Page IR lead + senior analysts + CISO\n# P2\u002FHigh: Page IR lead + available analysts\n# P3\u002FMedium: Assign to next available analyst\n# P4\u002FLow: Queue for business hours processing\n\ncurl -X POST \"https:\u002F\u002Fevents.pagerduty.com\u002Fv2\u002Fenqueue\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"routing_key\": \"'$PD_ROUTING_KEY'\",\n    \"event_action\": \"trigger\",\n    \"payload\": {\n      \"summary\": \"P1 Security Incident: Ransomware detected on PROD-DB-01\",\n      \"severity\": \"critical\",\n      \"source\": \"SIEM-Splunk\",\n      \"custom_details\": {\"incident_id\": \"IR-2024-042\", \"playbook\": \"ransomware_v2\"}\n    }\n  }'\n```\n\n### Step 7: Document Triage Decision and Hand Off\n```bash\n# Update incident ticket with triage summary\ncurl -X PATCH \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\u002F$CASE_ID\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"status\": \"InProgress\",\n    \"customFields\": {\n      \"triage_analyst\": {\"string\": \"analyst_name\"},\n      \"triage_time\": {\"date\": '$(date +%s000)'},\n      \"severity_justification\": {\"string\": \"Critical asset + active threat + PCI data\"}\n    }\n  }'\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| True Positive | Alert correctly identifying a real security incident |\n| False Positive | Alert incorrectly flagging benign activity as malicious |\n| Severity Classification | Ranking incident priority based on impact and urgency |\n| Playbook Selection | Choosing the appropriate response procedure based on incident type |\n| IOC Enrichment | Adding context to indicators from threat intelligence sources |\n| Escalation Threshold | Criteria triggering escalation to higher severity or management |\n| Triage SLA | Time target for initial assessment (typically 15-30 min for critical) |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| Splunk\u002FElastic\u002FQRadar | SIEM alert correlation and querying |\n| TheHive\u002FSIRP | Incident case management and playbook tracking |\n| VirusTotal\u002FAbuseIPDB | IOC reputation and enrichment |\n| PagerDuty\u002FOpsGenie | On-call management and alerting |\n| MITRE ATT&CK | Technique classification and mapping |\n| Cortex XSOAR | SOAR platform for automated triage workflows |\n\n## Common Scenarios\n\n1. **Brute Force Alert**: Multiple failed logins from single IP. Enrich IP reputation, check geo-location, verify if account was compromised, assign P3 if unsuccessful.\n2. **Malware Detection on Endpoint**: AV\u002FEDR quarantined malware. Verify quarantine success, check for lateral movement, assign P2 if persistence detected.\n3. **Suspicious Outbound Traffic**: Large data transfer to unknown external IP. Check if known cloud service, verify data classification, assign P1 if exfiltration confirmed.\n4. **Phishing Email Reported**: User reports suspicious email. Extract IOCs, check if others received it, assign P2 if credentials were entered.\n5. **Privilege Escalation**: User gained admin rights unexpectedly. Verify if authorized change, check for exploitation, assign P1 if unauthorized.\n\n## Output Format\n- Triage decision document with severity justification\n- Incident ticket with assigned playbook and team\n- IOC enrichment summary attached to case\n- Escalation notification to appropriate stakeholders\n- Initial timeline of events from alert data\n",{"name":5,"tags":25,"author":31,"domain":32,"source":33,"license":15,"version":34,"nist_csf":35,"subdomain":26,"description":7,"mitre_attack":40,"source_commit":45},[26,27,28,29,30],"incident-response","triage","playbook","severity-classification","soc","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0",[36,37,38,39],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01",[41,42,43,44],"T1486","T1490","T1070","T1078","04450304b12645cb2b974ab96d28c0664758a88d","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-12 23:12:27",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill triaging-security-incident-with-ir-playbook",{"tool":62,"command":63},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill triaging-security-incident-with-ir-playbook",{"tool":65,"command":66},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill triaging-security-incident-with-ir-playbook","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002FSKILL.md",true,[70,76,80,86,90,94,100],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"assets\u002Ftemplate.md","ASSET","资产文件",2921,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Fassets\u002Ftemplate.md",{"path":77,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"references\u002Fapi-reference.md","REFERENCE","参考文档",1963,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Freferences\u002Fapi-reference.md",{"path":87,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":88,"sourceHtmlUrl":89},"references\u002Fstandards.md",2361,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Freferences\u002Fstandards.md",{"path":91,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fworkflows.md",4705,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Freferences\u002Fworkflows.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",8659,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Fscripts\u002Fagent.py",{"path":101,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fprocess.py",15558,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Ftriaging-security-incident-with-ir-playbook\u002Fscripts\u002Fprocess.py",[105,113,120,128,136,144],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":109,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":124,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":132,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":20},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":140,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":145,"name":146,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":149,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]