Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incidentnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill triaging-security-incident -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/triaging-security-incidentgh skill install mukul975/Anthropic-Cybersecurity-Skills triaging-security-incidentgit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/triaging-security-incident ~/.claude/skills/triaging-security-incident # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/triaging-security-incident ~/.agents/skills/triaging-security-incident # Codex, Cursor, Gemini CLI, Copilot, OpenCode