Agent Skills
› mtarcure/claude-vibe-squad
› incident-response-runbook
incident-response-runbook
GitHub用于处理疑似或活跃的安全入侵事件，执行证据保全、隔离遏制、根除恢复及事后复盘的标准流程。强调人工审批与证据链完整，区别于普通可靠性故障。
触发场景
检测到安全入侵迹象
需要执行安全事件响应流程
安装
npx skills add mtarcure/claude-vibe-squad --skill incident-response-runbook -g -y
SKILL.md
Frontmatter
{
"name": "incident-response-runbook",
"audience": "specialist",
"description": "Use when a suspected or active security compromise must move through evidence-preserving triage, containment planning, eradication, recovery, and post-incident review while every live action remains separately operator-gated. Not for an ordinary reliability outage or chronology reconstruction alone."
}
Incident Response Runbook
Drive a suspected/active security incident through triage → contain → eradicate → recover → review without destroying evidence.
Steps
- Triage: establish scope, severity, and whether compromise is suspected (vs a reliability fault →
site-reliability-engineer). - Preserve volatile evidence before changing any state; record collection metadata and hashes.
- Propose containment; map every live action (isolate, block, rotate, wipe) to its
operator_gateand hold for approval. - Eradicate root cause; hand the observed TTP to
detection-engineer. - Recover and validate against explicit recovery-criteria with user-facing signals.
- Run a post-incident review: root cause, lessons, hardening.
Acceptance
- Evidence captured before any state change; chain of custody preserved.
- Every live action is operator-approved before execution; unknowns preserved, not guessed.
- Recovery is validated by a user-facing indicator, not assumed.
版本历史
- d5262e2 当前 2026-09-11 11:16
