.

security/operations/incident-response/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: incident-response
+description: Handle security incidents with IR playbooks and procedures. Implement detection, containment, eradication, and recovery processes. Use when responding to security events or building incident response capabilities.
+license: MIT
+metadata:
+  author: devops-skills
+  version: "1.0"
+---
+
+# Incident Response
+
+Handle security incidents effectively with structured response procedures.
+
+## Incident Response Phases
+
+```yaml
+phases:
+  1_preparation:
+    - IR team and contacts
+    - Tools and access ready
+    - Playbooks documented
+    
+  2_detection:
+    - Alert triage
+    - Initial assessment
+    - Severity classification
+    
+  3_containment:
+    - Short-term containment
+    - Evidence preservation
+    - System isolation
+    
+  4_eradication:
+    - Root cause analysis
+    - Remove threat
+    - Patch vulnerabilities
+    
+  5_recovery:
+    - System restoration
+    - Monitoring enhanced
+    - Business continuity
+    
+  6_lessons_learned:
+    - Post-incident review
+    - Documentation update
+    - Process improvement
+```
+
+## Severity Classification
+
+| Level | Impact | Response Time |
+|-------|--------|---------------|
+| Critical | Data breach, full outage | Immediate |
+| High | Service degraded, potential breach | < 1 hour |
+| Medium | Limited impact, contained | < 4 hours |
+| Low | Minimal impact | Next business day |
+
+## Initial Response Checklist
+
+```markdown
+- [ ] Confirm incident is real (not false positive)
+- [ ] Classify severity level
+- [ ] Notify IR team
+- [ ] Begin documentation
+- [ ] Preserve evidence
+- [ ] Implement containment
+- [ ] Communicate to stakeholders
+```
+
+## Evidence Collection
+
+```bash
+# System state
+ps aux > /evidence/processes.txt
+netstat -tuln > /evidence/connections.txt
+last -a > /evidence/logins.txt
+
+# Memory dump
+dd if=/dev/mem of=/evidence/memory.dump
+
+# Log preservation
+tar czf /evidence/logs.tar.gz /var/log/
+```
+
+## Best Practices
+
+- Pre-defined playbooks
+- Regular IR drills
+- Clear communication channels
+- Legal team involvement
+- Post-incident reviews
+
+## Related Skills
+
+- [audit-logging](../../../compliance/auditing/audit-logging/) - Log analysis
+- [alerting-oncall](../../../devops/observability/alerting-oncall/) - Alert management