Guide · Agent skill
How to use the Incident Response Dashboard Builder agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the building-incident-response-dashboard agent skill, a set of instructions and search queries that lets an AI agent help you design a dashboard for tracking an active security incident in Splunk. It is written for people who have never installed an agent skill. By the end you will know what the skill does, how to install it, how to ask for it in plain language, and what you need in place before the queries will run.
Incident Response Dashboard Buildermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it. You should end up with a folder containing SKILL.md, scripts/agent.py and references/api-reference.md.
- 2Place the skill folder. Move the unzipped folder into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder.
- 3Check your Splunk data. Confirm you have notable or incident_review data and the lookup files the skill uses, such as ir_affected_systems.csv.
- 4Ask for a dashboard in plain language. Describe the incident, the panels you need and the audience, for example affected systems and containment status for leadership.
- 5Review the SPL before running it. Read each search the agent produces and replace sample values such as IPs, hashes and incident IDs with your own.
- 6Build panels in Dashboard Studio. Paste the XML or searches into a Dashboard Studio dashboard and confirm each panel returns expected results.
- 7Review the script before any connection. If you use scripts/agent.py, read it and test against a non-production Splunk instance before pointing it at production.
What the skill makes the agent do
When installed, the agent can design a dashboard for tracking an active security incident. The skill provides layouts and search queries for affected systems, containment progress, indicators of compromise (IOCs), a response timeline, and SOC performance metrics such as detection and response times.
The skill is built around Splunk Dashboard Studio and Splunk Enterprise Security notable and incident_review data. It also includes a Python helper, scripts/agent.py, that can query a Splunk instance to pull incident summaries and affected-system data.
- Incident summary panels (status, severity, affected and contained hosts, IOC count)
- Affected systems panel built from an ir_affected_systems.csv lookup
- IOC tracking panel and new-IOC discovery list from ir_ioc_list.csv
- Response timeline panel from ir_timeline.csv
- SOC operations panels: incident volume, MTTD, MTTR, analyst workload, disposition breakdown
- Executive briefing panels for leadership
Install the skill
Download the skill ZIP from this page and unzip it. Then place the folder in one of two locations. For a personal install available across your projects, unzip into ~/.claude/skills/. For a single project, unzip into that project's .claude/skills/ folder.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload
Trigger the skill with natural requests
You do not need a special command. Describe the task in plain language and mention incident response dashboards, Splunk, or the kind of view you need. The skill's description says it applies when IR teams need unified visibility during incident coordination and post-incident reporting.
Be specific about the incident and the audience. Naming the data you have (for example, an affected-systems lookup) helps the agent use the matching queries.
- "Build a Splunk dashboard to track the affected hosts and containment status for our active ransomware incident."
- "Give me SPL to chart IOC spread across the environment since the incident began."
- "Create an executive briefing panel summarising incident status and business impact for leadership."
- "Write MTTD and MTTR searches against our Splunk notable index for the last 30 days."
What you need before you start
The skill assumes a working SIEM. Its examples are written for Splunk with Dashboard Studio, and the source does not provide Elastic or Grafana equivalents. Your Splunk data should include notable event and incident data, typically the incident_review index in Enterprise Security.
The bundled script needs Python with the splunklib (Splunk SDK) library and a Splunk username and password to connect. Lookup files such as ir_affected_systems.csv, ir_ioc_list.csv and your asset lookups are also expected.
- Splunk instance with Dashboard Studio
- Splunk Enterprise Security notable/incident_review data
- Python with splunklib for scripts/agent.py
- Splunk username and password or other credentials for the script
- Lookup files: ir_affected_systems.csv, ir_ioc_list.csv, asset lookups
- Dashboard publishing access for your SOC and management audiences
Safety notes: scripts and network access
This skill runs scripts and uses the network. The bundled scripts/agent.py connects to a Splunk instance with a username and password and runs searches. Review the script and the connection settings before running it, and do not point it at a production Splunk until you have checked what it does.
The reference file references/api-reference.md shows a sample connection to localhost on port 8089 with placeholder credentials. Replace any placeholder credentials with your own through a secure method rather than hard-coding real passwords in files.
- Read scripts/agent.py before running it
- Test against a non-production Splunk instance first
- Do not store real passwords in plain text in shared files
- Some sample searches use placeholder values such as IP addresses, hashes and incident IDs; replace them with your own data
Example: a starter incident summary panel
The skill includes a Dashboard Studio XML starter with a single-value summary panel. It uses a makeresults search with sample values so you can see the layout before connecting real data. Replace the sample values with searches against your own lookups and indexes.
<dashboard version="2" theme="dark">
<label>Active Incident Response Dashboard</label>
<row>
<panel>
<title>Incident Summary</title>
<single>
<search>
<query>
| makeresults
| eval incident_id="IR-2024-0450", status="CONTAINMENT", severity="Critical", affected_hosts=7, contained_hosts=5, iocs_identified=23
| table incident_id, status, severity, affected_hosts, contained_hosts, iocs_identified
</query>
</search>
</single>
</panel>
</row>
</dashboard>Tips for getting good results
The skill itself says that for day-to-day SOC monitoring, the built-in Incident Review is the better choice. Use this skill for coordinating an active incident, management reporting, and post-incident review.
Build the dashboard in stages. Start with the summary and affected-systems panels, confirm the lookups return data, then add IOC, timeline and metrics panels.
- Use the skill for active incident coordination, not routine monitoring
- Confirm each lookup returns rows before building panels on top of it
- Keep sample data clearly labelled so nobody mistakes it for live results
What people use it for
- Coordinating a SOC team's shared view of affected hosts and containment progress during an active incident
- Tracking IOC spread across indexes with a timechart and a new-IOC discovery list
- Building a response timeline panel from a timeline lookup for post-incident review
- Reporting MTTD, MTTR and alert disposition breakdowns to SOC leadership
- Preparing an executive briefing panel with incident status and business impact
Frequently asked questions
How do I install the building-incident-response-dashboard skill?
Download the skill ZIP from this page and unzip it. Place the folder in ~/.claude/skills/ for a personal install, or in a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Is this skill free to use?
The skill is licensed under Apache-2.0, as listed on this page. Check the licence file included with the download for the full terms. This page does not state any price.
What do I need to run it?
You need a Splunk instance with Dashboard Studio and Enterprise Security notable or incident_review data, plus lookup files such as ir_affected_systems.csv and ir_ioc_list.csv. The bundled script also needs Python with splunklib and Splunk credentials.
Does it work with Elastic or Grafana?
The skill mentions Elastic and Grafana in its description, but the included files provide Splunk queries only. Elastic or Grafana equivalents are not provided in the files, so the searches will not run there as written.
Is it safe to run scripts/agent.py?
The script connects to Splunk with a username and password and runs searches, so it uses the network. Read the script first and test against a non-production instance before using a production Splunk.
Why is the agent not using this skill?
Make sure the folder is in a location the agent reads and that SKILL.md is inside it. Also phrase the request around an active incident dashboard in Splunk. For routine monitoring, the skill itself recommends Incident Review instead.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits SOC teams coordinating an active incident, security engineers who already run Splunk and want starter dashboard searches, and leadership teams who need incident status and metrics. It is not a good fit for day-to-day monitoring, for teams without Splunk, or for anyone who will run the bundled script against production without reviewing it first.
Download the skill