Classifies and prioritizes security incidents using structured IR playbooks and SIEM/case-management queries (Splunk, TheHive) to determine severity, assign response teams, and initiate the appropriate response procedures. Use when a new SOC alert needs triage, multiple concurrent incidents require prioritization, or automated triage rules need validation or tuning.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident-with-ir-playbooknpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident-with-ir-playbook -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident-with-ir-playbook -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/triaging-security-incident-with-ir-playbookgh skill install mukul975/Anthropic-Cybersecurity-Skills triaging-security-incident-with-ir-playbookgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/triaging-security-incident-with-ir-playbook ~/.claude/skills/triaging-security-incident-with-ir-playbook # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/triaging-security-incident-with-ir-playbook ~/.agents/skills/triaging-security-incident-with-ir-playbook # Codex, Cursor, Gemini CLI, Copilot, OpenCode