cyber-ir-playbook
Build incident response timelines and report packs from event logs. Use for detection-to-recovery reporting, phase tracking, and stakeholder-ready incident summaries.
70
1.59x
Quality
53%
Does it follow best practices?
Impact
99%
1.59xAverage score across 3 eval scenarios
Securityby
Passed
No known issues
Optimize this skill with Tessl
npx tessl skill review --optimize ./skills/0x-professor/cyber-ir-playbook/SKILL.mdCyber IR Playbook
Overview
Convert incident events into a standardized response timeline and phase-based report.
Workflow
- Ingest incident events with timestamps.
- Classify events into detection, containment, eradication, recovery, or post-incident phases.
- Build ordered timeline and summarize current phase completion.
- Produce a report artifact for internal and executive audiences.
Use Bundled Resources
- Run
scripts/ir_timeline_report.pyto generate a deterministic timeline report. - Read
references/ir-phase-guide.mdfor phase mapping guidance.
Guardrails
- Focus on defensive incident handling and post-incident learning.
- Do not provide offensive exploitation instructions.
- Repository
- openclaw/skills
- Commit
754c182
- Last updated
- Created
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.