responding-to-security-incidents

About responding-to-security-incidents

Assists with security incident response, investigation, and remediation. This skill is triggered when the user requests help with incident response, mentions specific incident types (e.g., data breach, ransomware, DDoS), or uses terms like "incident response plan", "containment", "eradication", or "post-incident activity". It guides the user through the incident response lifecycle, from preparation to post-incident analysis. It is useful for classifying incidents, creating response playbooks, collecting evidence, constructing timelines, and generating remediation steps. Use this skill when needing to respond to a "security incident".

协助处理安全事件响应、调查和修复。当用户请求帮助处理事件响应、提到特定事件类型（例如数据泄露、勒索软件、DDoS）或使用诸如“事件响应计划”、“遏制”、“根除”或“事件后活动”等术语时，将触发此技能。它指导用户完成事件响应生命周期，从准备到事件后分析。它对于分类事件、创建响应手册、收集证据、构建时间轴和生成修复步骤非常有用。当需要响应“安全事件”时，请使用此技能。