Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    Incident Lessons Learned Review

    1

    Convert cyber incident evidence into blameless post-mortem reports, root cause analyses, and action trackers.

    $10

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    0 installsSecurity scanned
    incident-lessons-learned-review

    incident-lessons-learned-review

    Example session with this skill installed

    Facilitate a post-incident lessons learned review for a business email compromise that occurred last month. Initial access was via a phishing email that bypassed email filtering. Containment took 72 hours. Key stakeholders are the SOC, IT operations, and the CISO. Produce a blameless review report, improvement action tracker, and executive summary.

    • Read your context and instructions
    • Compiled the incident-lessons-learned-review

    The skill produces a structured blameless post-incident review report covering incident scope and timeline, response performance metrics (MTTD, MTTI, MTTC, MTTR), root cause analysis using a five-whys methodology, a blameless review of what went well and what needs improvement, a prioritised improvement action tracker with placeholder owners and due dates, a playbook update requirement list, and a one-page executive summary suitable for CISO or board reporting. All ownership assignments and SLA targets requiring organisational confirmation are clearly marked as placeholders throughout.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Conduct 5-Why root cause analysis for security incidentsGenerate executive summaries of cyber tabletop exercisesConvert incident timelines into tracked remediation actionsIdentify gaps in IR playbooks and detection logic from real events

    About this skill

    Professional Defensive Post-Incident Reviews

    Transform chaotic incident data into structured, actionable intelligence. This skill facilitates deep-dive lessons learned sessions following cyber security incidents, near misses, or tabletop exercises. It moves beyond simple summarization, applying rigorous analysis methods to improve your organization's security posture.

    What it does

    • Evidence Synthesis: Consolidates incident timelines, logs, and stakeholder inputs into a single source of truth.
    • Blameless Analysis: Conducts root cause analysis (RCA) using 5-Whys or Fishbone methods, focusing on systemic improvements rather than individual fault.
    • Metric Generation: Calculates key performance indicators like MTTR and MTTC based on provided timestamps.
    • Actionable Outputs: Generates executive summaries, playbook update plans, and tracked action items with clear owners and validation criteria.

    Why use this skill

    Standard AI prompting often yields generic retrospective advice. This skill enforces strict defensive IR standards, ensuring outputs are evidence-based, tool-agnostic (unless specified), and audit-ready. It bridges the gap between technical recovery and executive reporting, ensuring that "lessons learned" actually result in updated playbooks and detection logic.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 4 months ago

    • Passed all security checks, Safe to install

    Listed4 months ago

    What's inside

    Frequently Asked Questions