Installs into .claude/skills of the current project.
Are you the author of Edr Triage?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/backbay-labs-edr-triage)
# bb-edr: Triage Skill
Use this skill to turn clawdstrike audit logs into an incident report and a minimal response plan.
## Inputs
- `.hush/audit.jsonl` (JSONL) — clawdstrike audit events (allowed/denied, guard, reason).
- `policy.yaml` — the active security policy.
## Task
1. Read and summarize the last ~50 audit events.
2. Focus on **denied** events first:
- Group by `guard` (e.g., `forbidden_path`, `egress`, `patch_integrity`)
- Identify likely intent (misconfiguration vs. suspicious)
3. Produce a short incident report:
- What happened (timeline + key indicators)
- Impact assessment (what was attempted, what was blocked)
- Recommended response (least-privilege)
4. If you propose any response action (writing files, changing config), **use `policy_check` first** and keep changes scoped to this project directory.
## Output
- Write `./reports/incident.md` containing the final report.
## Notes (important)
- clawdstrike enforces at the **tool boundary**. It is not an OS sandbox.
- If an operation is denied, treat it as a strong indicator of suspicious behavior or incorrect policy assumptions.
