NIST SP 800-61r3-aligned incident triage that preserves evidence, separates analysis from authorization, and records status. Use for incident intake, severity assessment, containment readiness, or evidence preservation; not generic debugging or unscoped response.
Pro scans all 2 files and shows the line behind each finding
Scanned 9/24/2026
Skills Directorynpx -y skills add HoangNguyen0403/agent-skills-standard --skill cyber-incident-triage --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Cyber Incident Triage?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-cyber-incident-triage-8445d2d8)More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.
---
name: cyber-incident-triage
guardrail: true
description: NIST SP 800-61r3-aligned incident triage that preserves evidence, separates analysis from authorization, and records status. Use for incident intake, severity assessment, containment readiness, or evidence preservation; not generic debugging or unscoped response.
metadata:
triggers:
files: []
keywords:
- incident triage
- security incident
- incident intake
- preserve evidence
- containment readiness
- NIST 800-61
---
# Cyber Incident Triage
## **Priority: P0 (CRITICAL)**
Preserve evidence and prevent unauthorized response.
## Structure
Input: claim, time, asset/context, source, scope, owner. Process: preserve originals; assess hypothesis; separate analysis, containment, eradication, recovery; cite gaps. Output: status, evidence references, limitations, owner, next approved action.
## Rules
- Active collection, isolation, eradication, or production changes require engagement/scope reference, approved operation, owner, and runtime-proven controls.
- Missing, expired, or unsupported scope blocks operations; continue safe offline analysis.
- Status: `confirmed`, `suspected`, `blocked`, `not-tested`, or `false-positive`. Severity is urgency/impact, never proof.
- Preserve acquisition method, timestamps, hashes where available, custodian, and original references. Missing evidence is not clean.
- Always record `accountable_owner`. If no owner is supplied, use `unassigned` and require the incident-response lead to assign an incident owner before handoff or closure; never invent a person, approval, or completed assignment.
- Require independent approval for disruptive containment. Runtime—not Markdown—enforces permissions, credentials, network scope, and cancellation.
## Anti-Patterns
- Never delete, isolate, reset, scan, or modify production from prose alone.
- Never convert high severity, an empty dashboard, or a missing artifact into confirmation.
- Never fabricate indicators, confidence, chain of custody, recovery, or efficacy.
## References (lazy, primary)
- NIST SP 800-61r3: https://doi.org/10.6028/NIST.SP.800-61r3
- NIST SP 800-86 evidence handling: https://doi.org/10.6028/NIST.SP.800-86
- Reuse `cyber-authorization`, `cyber-evidence`, `cyber-framework-mapping`.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
