Security Incident Response (SIRT)

This skill handles the 'What if we get hacked?' scenario, with a focus on speed and damage control.

Instructions

1. Create 'Playbooks' for different attack types (DDoS, Leak, Ransomware).
2. Automate 'Isolation' steps (Ex. Auto-revoke a compromised API key).
3. Set up a 'Forensics' workflow to capture logs and state for analysis.
4. Draft communication templates for notifying affected users and authorities.
5. Perform post-incident reviews to prevent future occurrences.

Examples

• "Create a playbook for what to do if an admin's GitHub account is compromised."
• "Automate the isolation of a server instance if a malware signature is detected."