mcpField
S
security-incident-playbook-generator

security-incident-playbook-generator

github.com/patricio0312rev安全63213 次安装41 周前更新
代码仓库

关于 security-incident-playbook-generator

用于制定结构化安全事件响应手册的技能，检查清单涵盖响应阶段、遏制措施、沟通、证据收集和事后复盘。

主要功能

  1. 01结构化响应阶段
  2. 02遏制处置流程
  3. 03沟通模板
  4. 04证据收集规则
  5. 05事件后复盘清单

适用场景

  1. 01起草安全事件响应手册
  2. 02明确遏制和证据处理流程
  3. 03准备事件沟通模板

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/patricio0312rev/skills --skill security-incident-playbook-generator

安装后在 Claude Code 中输入/security-incident-playbook-generator确认已加载。

详细介绍

安全事件应对手册生成器

通过结构化的应对计划，为安全事件做好准备。

事件响应阶段

# Security Incident Response Playbook

## Phase 1: Detection & Triage (0-15 min)

### Detection Sources

- Security alerts (CloudWatch, Sentry)
- User reports
- Anomaly detection
- Penetration test findings

### Initial Assessment

- [ ] Identify incident type
- [ ] Assess severity (P0-P3)
- [ ] Determine scope
- [ ] Alert on-call security

## Phase 2: Containment (15-60 min)

### Immediate Actions

- [ ] Isolate affected systems
- [ ] Revoke compromised credentials
- [ ] Block malicious IPs
- [ ] Enable enhanced monitoring

### Evidence Preservation

- [ ] Capture logs
- [ ] Take system snapshots
- [ ] Document timeline
- [ ] Preserve artifacts

## Phase 3: Eradication (1-24 hours)

- [ ] Remove malware
- [ ] Close vulnerabilities
- [ ] Reset passwords
- [ ] Update firewall rules

## Phase 4: Recovery (24-72 hours)

- [ ] Restore from backup
- [ ] Verify system integrity
- [ ] Resume operations
- [ ] Monitor for reinfection

## Phase 5: Post-Incident (1 week)

- [ ] Document lessons learned
- [ ] Update procedures
- [ ] Security training
- [ ] Notify affected users (if required)

输出清单

  • 定义响应阶段
  • 遏制流程
  • 沟通模板
  • 证据收集规则
  • 事件后审查 ENDFILE

评论

支持 Markdown