Security Incident Summarization

Overview

This skill enables SOC analysts and security managers to generate structured summaries of security incidents at multiple levels of detail. It produces both executive summaries for leadership and technical summaries for operational teams, ensuring consistent communication about incident status, impact, and response actions.

Key capabilities:

• Generate concise executive summaries suitable for CISO and management briefings
• Produce detailed technical summaries with IOCs, attack vectors, and forensic findings
• Classify threats using standardized categories and MITRE ATT&CK mapping
• Inventory affected assets with business criticality context
• Summarize containment status and response progress
• Compile recommended actions prioritized by urgency

When to use: When a security incident requires communication to stakeholders at any level, including management updates, cross-team coordination, regulatory notifications, or documentation for compliance.

Prerequisites