multiAI Summary Pending
cyber-ir-playbook
Build incident response timelines and report packs from event logs. Use for detection-to-recovery reporting, phase tracking, and stakeholder-ready incident summaries.
3,556 stars
byopenclaw
Installation
Claude Code / Cursor / Codex
$curl -o ~/.claude/skills/cyber-ir-playbook/SKILL.md --create-dirs "https://raw.githubusercontent.com/openclaw/skills/main/skills/0x-professor/cyber-ir-playbook/SKILL.md"
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/cyber-ir-playbook/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How cyber-ir-playbook Compares
| Feature / Agent | cyber-ir-playbook | Standard Approach |
|---|---|---|
| Platform Support | multi | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Build incident response timelines and report packs from event logs. Use for detection-to-recovery reporting, phase tracking, and stakeholder-ready incident summaries.
Which AI agents support this skill?
This skill is compatible with multi.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Cyber IR Playbook ## Overview Convert incident events into a standardized response timeline and phase-based report. ## Workflow 1. Ingest incident events with timestamps. 2. Classify events into detection, containment, eradication, recovery, or post-incident phases. 3. Build ordered timeline and summarize current phase completion. 4. Produce a report artifact for internal and executive audiences. ## Use Bundled Resources - Run `scripts/ir_timeline_report.py` to generate a deterministic timeline report. - Read `references/ir-phase-guide.md` for phase mapping guidance. ## Guardrails - Focus on defensive incident handling and post-incident learning. - Do not provide offensive exploitation instructions.