Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsSecurity Incident Triage
Professional security incident triage for SOC teams to classify alerts, assess severity, and draft response plans.
$10
security-incident-triage
Example session with this skill installed
Triage the following alert: an endpoint detection platform flagged suspicious PowerShell execution on a finance workstation at 02:14 UTC followed by LSASS memory access attempts. The user was not logged in at the time. Assess severity, classify the incident type, map any TTPs, and provide an initial action plan.
- Read your context and instructions
- Compiled the security-incident-triage
The skill produces a structured triage report classifying the incident as P1 Critical under NIST SP 800-61 category TA0006 (Credential Access), with MITRE ATT&CK technique mappings for T1059.001 (PowerShell) and T1003.001 (LSASS Memory), a severity assessment with evidence basis and confidence level, an escalation recommendation targeting the incident commander, an initial action plan covering evidence preservation, endpoint isolation, and threat intelligence enrichment, and a structured incident ticket summary ready for case management import. All assumptions and validation points requiring confirmation are clearly marked.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
High-Level Security Triage for SOC & DevOps
This skill provides a structured framework for analyzing security alerts, user reports, and threat intelligence matches. It bridges the gap between raw log data and actionable incident response by automating the initial triage process.
What it does
The skill acts as a virtual SOC Tier 1/2 analyst. It ingest evidence—such as process chains, network connections, and file hashes—to produce a severity-assessed incident report. It prioritizes response efforts, recommends escalation paths, and maps activities to the MITRE ATT&CK framework when evidence supports it.
Why use this skill?
- Structured Methodology: Unlike generic AI prompts, this skill follows rigorous defensive security principles, separating confirmed facts from assumptions.
- Tool Agnostic: Works across any EDR, SIEM, or cloud identity platform by requesting specific context when needed.
- Operational Safety: Includes built-in guardrails against providing offensive guidance or recommending destructive containment without authorization.
- Ready for Integration: Produces summaries specifically formatted for incident tickets (Jira, ServiceNow) or executive briefings.
The Result
You receive a comprehensive triage report including a severity rationale, affected scope, evidence summary, and a prioritized initial action plan for your security operations team.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 4 months ago
- Passed all security checks, Safe to install