How to use the Containing Active Breaches agent skill

What the skill makes the agent do

The skill tells the agent to work through containment in a fixed order. It starts by assessing scope so that containment does not tip off the adversary through partial action. It then covers short-term containment (network isolation, blocking C2, disabling accounts, terminating malicious processes), long-term containment (network ACLs, temporary jump hosts, enhanced monitoring), validation that the adversary has actually stopped, evidence preservation, and status reporting to the incident commander.

It also includes a Python helper script, scripts/agent.py, which the source says can run firewall-blocking and Active Directory account-disabling commands on a system. A reference file, references/api-reference.md, contains example API calls for EDR host containment, such as CrowdStrike Falcon containment and Microsoft Defender for Endpoint isolation.

How to install the containing-active-breach skill

Download the skill ZIP from this page. Then choose one of two routes. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings, go to Capabilities, and upload the skill under Skills.

After installing, the folder should contain SKILL.md, scripts/agent.py and references/api-reference.md. SKILL.md is the file that describes when the skill activates.

• Personal: unzip into ~/.claude/skills/
• Project: unzip into the project's .claude/skills/
• Claude apps: Settings, then Capabilities, then Skills, then upload

How to trigger the skill with natural requests

You do not need a special command. The skill activates for requests about breach containment, lateral movement prevention, network isolation, active threat containment, or live incident response. Describe the situation and what you need, and state that the incident is confirmed.

The source is clear that the skill is for confirmed, active breaches. Give the agent the facts you have, such as affected hosts, accounts or C2 indicators, so it can build the scope assessment first.

• "We have a confirmed intrusion in progress. Help me map the compromised hosts and accounts before we isolate anything."
• "Ransomware is spreading from WKSTN-042. Walk me through short-term containment steps."
• "Our service account appears to be used for lateral movement. What should we disable and rotate, and in what order?"
• "Draft a containment validation checklist for the finance VLAN."

What you need before you start

The skill is not useful on its own. The source lists these requirements for the full workflow: Python 3 to run scripts/agent.py; root or equivalent privileges for iptables commands on Linux; PowerShell with the Active Directory module and AD admin rights for Windows account disabling; EDR console access (for example CrowdStrike Falcon, Microsoft Defender for Endpoint or SentinelOne); and firewall and AD admin credentials.

The source also lists prerequisites for the incident itself: a confirmed incident classified P1 or P2 from triage, pre-approved containment authority in your incident response plan, and an evidence preservation plan.

• Python 3 to run scripts/agent.py
• Root or equivalent privileges for iptables on Linux
• PowerShell with the Active Directory module and AD admin rights on Windows
• EDR console access with host isolation capability
• Firewall and AD admin credentials
• Pre-approved containment authority and a confirmed P1 or P2 incident

Safety notes: scripts and network use

The skill runs scripts: scripts/agent.py can execute firewall-blocking and Active Directory account-disabling commands. Those actions can cause outages if they are run on the wrong system or without authority. Review what the script will do before running it, and run it only in an environment where you hold the required approval.

The source states that the skill does not use the network itself. The actions it describes, such as EDR isolation calls, are carried out through the tools you connect to, so those tools' access controls still apply. The KRBTGT double reset, which the source describes as resetting the password twice, 12 hours apart, is high-impact and should be treated as a decision for the incident commander.

• Do not run blocking, disabling or KRBTGT reset actions on unconfirmed alerts
• Do not delete disabled accounts; the source says to preserve the audit trail
• Capture memory and logs before remediation

Walkthrough: how a containment session flows

A typical session follows the skill's workflow. The agent first produces a scope assessment listing compromised hosts, accounts, C2 channels, lateral movement paths and the adversary's privilege level. It then proposes short-term containment, long-term containment and validation steps, and a checklist you can tick off as each action is confirmed.

Evidence collection runs alongside containment. The skill calls for memory capture (it names WinPmem or Magnet RAM Capture), volatile data collection, exporting event logs before they rotate, and timestamped documentation of every action.

• Scope: map hosts, accounts, C2 and lateral movement
• Contain: isolate endpoints, block C2, disable and reset accounts
• Preserve: capture memory, volatile data and logs
• Validate: confirm C2 has stopped and disabled accounts fail to log in
• Report: status, remaining risks, business impact and escalation needs

Tips for getting good results

Give the agent accurate inputs. The scope assessment is only as good as the telemetry you provide, so paste EDR and authentication log findings where you can. Keep a human in the loop for every action that disables accounts or changes firewall rules, and check each proposed command against your own change process before execution.

Use the skill for live response, then switch to eradication procedures once the adversary is no longer active. The skill itself says not to use it for post-incident cleanup.

• Provide EDR, SIEM and authentication log excerpts with your request
• Ask for the order of actions, not just a list
• Review every command before it runs
• Switch to eradication once the adversary is gone