360 Secure SkillHub
360 安全技能中心

Cyber IR Playbook

核心功能：导入带时间戳的事件日志，将其分类为检测、遏制、根除、恢复、事后5个响应阶段，生成有序时间线、阶段完成摘要及面向内部和高管的报告。典型场景：检测到恢复全流程汇报、响应阶段跟踪、向相关方提交事件总结。输入为带时间戳的事件日志，输出标准化时间线及报告包；配套有生成脚本及阶段映射指南，仅聚焦防御性处置与事后学习，不提供攻击指导。

0x-professor
0x-professor
热度 84.25
最近更新 2026-05-11 17:27:32
分类：安全依赖：代码执行 / 读写文件应用场景：数据处理 / 报告撰写 / 工作流

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add cyber-ir-playbook
Metadata
name
cyber-ir-playbook
description
Build incident response timelines and report packs from event logs. Use for detection-to-recovery reporting, phase tracking, and stakeholder-ready incident summaries.

Cyber IR Playbook

Overview

Convert incident events into a standardized response timeline and phase-based report.

Workflow

  1. Ingest incident events with timestamps.
  2. Classify events into detection, containment, eradication, recovery, or post-incident phases.
  3. Build ordered timeline and summarize current phase completion.
  4. Produce a report artifact for internal and executive audiences.

Use Bundled Resources

  • Run scripts/ir_timeline_report.py to generate a deterministic timeline report.
  • Read references/ir-phase-guide.md for phase mapping guidance.

Guardrails

  • Focus on defensive incident handling and post-incident learning.
  • Do not provide offensive exploitation instructions.