Contain an active or credible incident across hosts, identities, applications, cloud resources, networks, or data. Use when access, execution, exfiltration, fraud, destruction, or repeated compromise needs authorized interruption.
Installs into .claude/skills of the current project.
Are you the author of Contain Security Incident?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/gaelic-ghost-contain-security-incident)
---
name: contain-security-incident
description: Contain an active or credible incident across hosts, identities, applications, cloud resources, networks, or data. Use when access, execution, exfiltration, fraud, destruction, or repeated compromise needs authorized interruption.
---
# Contain Security Incident
## Overview
Interrupt the validated path of harm with the smallest effective action, then verify the containment. Do not confuse a blocked symptom with eradication or recovery.
Read [references/containment-plan.md](references/containment-plan.md) before making disruptive changes.
## Workflow
1. Confirm incident lead, authority, current scope, harm path, critical services, evidence priorities, and emergency contacts.
2. Model containment choices.
- Consider host/network isolation, process/service suspension, account disablement, session/token/key revocation, access-policy change, application feature disablement, route/rule changes, or provider controls.
- Record expected harm reduction, operational impact, volatile evidence loss, dependencies, rollback, and attacker visibility.
3. Sequence actions.
- Address active exfiltration/destruction/safety first, then privileged access, propagation, persistence, and re-entry paths.
- Coordinate simultaneous identity, host, application, and network actions when staggered changes would alert or strand access.
4. Apply approved changes.
- Record exact target, operator, time, command/control surface, result, failures, and unexpected effects.
5. Verify containment.
- Check that the harmful path stopped, access/session state changed, affected services remain understood, and monitoring still functions.
6. Expand scope carefully.
- Hunt for related indicators and access paths; update the incident record before new targets or actions.
7. Define exit criteria.
- State what evidence permits eradication/recovery and what temporary controls must remain.
## Output
Return containment objective, options/tradeoffs, actions/results, verification, residual access, business impact, temporary controls, rollback, and next-phase criteria.
