Initial incident intake & scoping

What this skill does

• Converts messy intake notes into a clear incident statement, assumptions, and immediate next actions.
• Produces an evidence request list tailored to the suspected incident type.
• Captures “known/unknowns” and identifies the critical time window.

When to use

• New case creation / first response.
• Handoff between SOC and IR.
• You need to quickly decide: contain now vs. observe vs. wait for more evidence.

Safety / privacy notes

• Don’t paste raw email bodies with PII unless necessary—prefer headers and redacted snippets.
• Don’t paste credentials, secrets, access tokens.