Guide · Agent skill
How to use the Incident Response Playbook Builder agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The Incident Response Playbook Builder is an agent skill, a folder of instructions and helper files that an AI agent loads when it recognises a matching task. Once it is installed, you can ask the agent to draft reusable incident response playbooks for a specific incident type, such as ransomware or phishing, following the NIST SP 800-61r3 and SANS PICERL frameworks. This guide explains what the skill does, how to install it, how to phrase requests, and what to check before you rely on the output.
Incident Response Playbook Buildermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the skill. Download the skill ZIP from this page and unzip it on your machine.
- 2Place the folder. Put the unzipped folder in ~/.claude/skills/ for personal use, or in a project's .claude/skills/ folder for one project.
- 3Or upload it in the Claude apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill.
- 4Install the Python dependency. Make sure Python 3 with the requests library is available, since scripts/agent.py imports it.
- 5Ask for a playbook. Describe the incident type, the frameworks you follow and the roles on your team in a plain request.
- 6Review and test. Check each command and escalation rule against your environment, then run a tabletop exercise.
What the skill makes the agent do
The skill is for designing and documenting structured incident response playbooks. A playbook is a documented, repeatable set of procedures for one incident type. The skill's instructions tell the agent to scope each playbook to a single incident type, then follow a fixed template with metadata, a RACI matrix, detection and triage, containment, eradication, recovery, post-incident work, communication and appendices.
The skill also covers decision trees with binary outcomes, escalation criteria, and outlines for automating playbook steps in a SOAR platform such as Cortex XSOAR or Splunk SOAR. It names a set of priority playbook types to build first, including ransomware, phishing and credential compromise, business email compromise, data breach and exfiltration, and insider threat.
- Step-by-step procedures for a specific incident type
- Decision trees and escalation criteria
- RACI (Responsible, Accountable, Consulted, Informed) tables
- Outlines for SOAR automation with approval gates for high-impact actions
- A Python helper script (scripts/agent.py) that holds template content for several playbook types
Install the skill (ZIP download or Claude apps upload)
Download the skill ZIP from this page and unzip it. For a personal setup, place the unzipped skill folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead.
If you use the Claude apps, you can upload the skill instead. Open Settings, go to Capabilities, then Skills, and upload the skill there.
- Personal install: ~/.claude/skills/ on your machine
- Project install: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills
Check what the skill needs before you run it
The skill's scripts import the requests library, so the helper script needs Python 3 with requests installed. SOAR platform access (Cortex XSOAR or Splunk SOAR) is optional and only needed if you want to build automated playbooks. The skill runs scripts and uses the network, so review those files before you run anything in a sensitive environment.
The reference file references/api-reference.md includes examples that call the TheHive API to create cases, tasks and observables from a playbook. Those examples use placeholder values such as a URL and an API key, which you must replace with your own.
- Python 3 with the requests library (imported by scripts/agent.py)
- Optional: SOAR platform access (Cortex XSOAR or Splunk SOAR)
- Files included: SKILL.md, scripts/agent.py, references/api-reference.md
Trigger the skill with natural requests
You do not need a special command. Describe the job in plain language and name the incident type and the outcome you want. The skill's description says it applies when you are creating or maturing an IR program, documenting response runbooks for a new incident type, or designing SOAR playbooks, so requests that match those tasks are the most likely to use it.
Be specific about your environment and frameworks. The skill expects you to name the standard you follow and the roles in your team, such as Incident Commander, SOC analysts, system administrators, legal and communications.
- Write a ransomware playbook aligned to NIST SP 800-61r3 with a RACI table for our SOC and incident commander.
- Draft a phishing and credential compromise playbook with a decision tree for triage and escalation.
- Outline SOAR automation steps for a business email compromise playbook, with approval gates for containment.
Review the output before you use it
Treat generated playbooks as drafts. The skill's own guidance says example commands and tool steps may not match your environment, so experienced responders should check every technical step, contact list and threshold. The skill also says it is not for live incident handling or one-time investigations, because playbooks are reusable procedure documents.
The skill's prerequisites assume you already have a risk assessment, an asset inventory with criticality ratings, and an inventory of your detections. Without those inputs, the agent's escalation criteria and priorities will be generic.
- Verify commands and tool procedures against your own tools and configurations
- Confirm severity thresholds and response timings with your IR lead
- Run tabletop exercises before relying on a playbook
What people use it for
- Building a first set of priority playbooks such as ransomware, phishing and data breach for a new security team
- Documenting a runbook for a new attack type after an incident, so the next responder has a written procedure
- Preparing documented IR procedures for audits such as SOC 2, PCI-DSS or HIPAA, which the skill lists as compliance drivers
- Outlining SOAR automations with analyst approval gates for containment actions
Frequently asked questions
Is the Incident Response Playbook Builder skill free to use?
The skill is published under the Apache-2.0 licence, as stated on its page. Check the licence file in the download for the full terms before you use or redistribute it.
What do I need to run the skill?
You need Python 3 with the requests library, because the helper script scripts/agent.py imports it. SOAR platform access, such as Cortex XSOAR or Splunk SOAR, is optional and only needed for automated playbooks.
Where do I install an agent skill?
Unzip the skill into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can upload it under Settings, then Capabilities, then Skills.
Can the skill handle live incidents?
No. The skill states it is not for one-time ad hoc investigations or live incident handling, because it produces reusable procedure documents.
Why does the skill say to review the output?
The skill notes that example commands and tool steps may not match your environment. Experienced responders should check generated procedures before you treat them as final.
Does the skill include tool-specific steps?
It includes example tool workflows and references to platforms such as Cortex XSOAR, Splunk SOAR, TheHive and Tines. Verify any tool-specific step against the exact product and configuration you use.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security teams building or maturing an incident response program, analysts writing a runbook after a new attack type, and teams preparing documented procedures for audits. It is a poor fit if you need help during a live incident or expect the generated procedures to be accepted without review by experienced responders.
Download the skill