From cybersecurity-skills
Triages security incidents using NIST SP 800-61r3 and SANS PICERL frameworks to classify type, assess severity based on business impact, and route to response teams. For SIEM/EDR alerts and suspicious activity.
npx claudepluginhub mukul975/anthropic-cybersecurity-skills --plugin cybersecurity-skillsThis skill uses the workspace's default tool permissions.
- A SIEM or EDR alert fires and requires human classification before escalation
Applies Acme Corporation brand guidelines including colors, fonts, layouts, and messaging to generated PowerPoint, Excel, and PDF documents.
Builds DCF models with sensitivity analysis, Monte Carlo simulations, and scenario planning for investment valuation and risk assessment.
Calculates profitability (ROE, margins), liquidity (current ratio), leverage, efficiency, and valuation (P/E, EV/EBITDA) ratios from financial statements in CSV, JSON, text, or Excel for investment analysis.
Do not use for routine vulnerability scanning results or compliance audit findings that do not represent active security incidents.
Gather all available context from the triggering alert before making classification decisions:
Example SIEM alert context:
Source: CrowdStrike Falcon
Detection: Suspicious PowerShell Execution (T1059.001)
Host: WORKSTATION-FIN-042
User: jsmith@corp.example.com
Timestamp: 2025-11-15T14:23:17Z
Severity: High (detection rule confidence: 92%)
Process: powershell.exe -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA...
Parent: outlook.exe (PID 4812)
Map the alert to a standard incident category per NIST SP 800-61r3:
| Category | Examples |
|---|---|
| Unauthorized Access | Compromised credentials, privilege escalation, IDOR |
| Denial of Service | Volumetric DDoS, application-layer flood, resource exhaustion |
| Malicious Code | Malware execution, ransomware detonation, cryptominer |
| Improper Usage | Policy violation, insider data exfiltration, shadow IT |
| Reconnaissance | Port scanning, directory enumeration, credential spraying |
| Web Application Attack | SQL injection, XSS, SSRF exploitation |
Calculate severity by combining asset criticality with threat severity:
Severity = f(Asset Criticality, Threat Type, Data Sensitivity, Lateral Movement Potential)
Critical (P1): Crown jewel systems compromised, active data exfiltration, ransomware spreading
High (P2): Production system compromise, confirmed malware execution, privileged account takeover
Medium (P3): Non-production compromise, unsuccessful exploitation attempt, single endpoint malware
Low (P4): Reconnaissance activity, policy violation, benign true positive
Response SLA targets:
Before escalation, enrich the alert with contextual data:
Create a structured triage record and route to the appropriate response tier:
Incident Triage Record
━━━━━━━━━━━━━━━━━━━━━
Ticket ID: INC-2025-1547
Triage Analyst: [analyst name]
Triage Time: 2025-11-15T14:35:00Z (12 min from alert)
Classification: Malicious Code - Macro-based initial access
Severity: P2 - High
Affected Assets: WORKSTATION-FIN-042 (Finance dept, handles PII)
Affected Users: jsmith@corp.example.com
IOCs Identified: powershell.exe spawned by outlook.exe, encoded command
TI Matches: Base64 payload matches known Qakbot loader pattern
Escalation: Tier 2 - Malware IR team
Recommended: Isolate endpoint, preserve memory dump, block sender domain
If severity is P1 or P2, initiate immediate containment actions while awaiting full investigation:
| Term | Definition |
|---|---|
| Triage | Rapid assessment process to classify and prioritize security incidents based on severity and business impact |
| PICERL | SANS incident response framework: Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned |
| Dwell Time | Duration between initial compromise and detection; average is 10 days per Mandiant M-Trends 2025 |
| True Positive Rate | Percentage of alerts from a detection rule that represent genuine security incidents |
| Crown Jewel Assets | Systems and data critical to business operations whose compromise would cause severe organizational impact |
| Alert Fatigue | Degraded analyst performance caused by high volumes of low-fidelity or false-positive alerts |
| Mean Time to Acknowledge (MTTA) | Average time from alert generation to analyst acknowledgment; key SOC performance metric |
Context: SOC analyst receives a P2 alert showing powershell.exe with a Base64-encoded command spawned as a child process of outlook.exe on a finance department workstation.
Approach:
Pitfalls:
INCIDENT TRIAGE REPORT
======================
Ticket: INC-[YYYY]-[NNNN]
Date/Time: [ISO 8601 timestamp]
Triage Analyst: [Name]
Time to Triage: [minutes from alert to classification]
CLASSIFICATION
Type: [NIST category]
Severity: [P1-P4] - [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
MITRE ATT&CK: [Technique ID and name]
AFFECTED SCOPE
Assets: [hostname(s), IP(s)]
Users: [account(s)]
Data at Risk: [classification level]
Business Unit: [department]
EVIDENCE SUMMARY
[Bullet list of key observations]
ENRICHMENT RESULTS
TI Matches: [Yes/No - details]
Historical: [Related prior incidents]
Asset Criticality: [rating]
RECOMMENDED ACTIONS
1. [Immediate action]
2. [Investigation step]
3. [Escalation target]
ESCALATION
Routed To: [Team/Individual]
SLA Target: [Containment deadline]