Guide · Agent skill
How to use the Post-Incident Lessons Learned agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains how to install and use the conducting-post-incident-lessons-learned skill, a set of instructions and bundled scripts that lets an AI agent run a structured review after a cybersecurity incident has been resolved. It is written for security teams, engineers and managers who may never have used an agent skill before. By the end you will know what the skill makes the agent do, how to add it to your setup, how to phrase a request that triggers it, and what to check before relying on its output.
Post-Incident Lessons Learnedmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download and unzip the skill. Download the ZIP from this page and unzip it so that SKILL.md sits in the skill folder.
- 2Place the folder. Move the folder into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. Alternatively, upload it under Settings → Capabilities → Skills in the Claude apps.
- 3Check the requirements. Confirm Python 3 is available. Install requests and jinja2 if you plan to use the bundled scripts.
- 4Confirm the incident is resolved. Make sure containment, eradication and recovery are complete before starting the review.
- 5Gather the data. Export the timeline, alerts and responder actions from your ticketing system and SIEM.
- 6Make a natural request. Ask the agent for the review in plain language, naming the incident ID and the outputs you need.
- 7Review and adapt the output. Check timestamps, metric definitions and root cause evidence before sharing the report.
What is an agent skill and what does this one do?
An agent skill is a folder of instructions, templates and optional scripts that an AI agent can load when a task matches its description. This skill's main file, SKILL.md, tells the agent how to facilitate a post-incident review: reconstructing the timeline, running a blameless post-mortem meeting agenda, performing root cause analysis, calculating response metrics and drafting outputs.
The skill covers the lessons-learned stage of incident handling. It is meant for incidents that are fully resolved, with containment, eradication and recovery complete.
- Reconstruct the incident timeline from ticketing and log data
- Run a 90-minute blameless post-mortem agenda covering what worked, what failed and playbook changes
- Perform root cause analysis, for example with the 5 Whys technique
- Calculate metrics such as dwell time, MTTD, MTTC, eradication duration and MTTR
- Draft meeting minutes, a root cause document, action items, an executive summary and updated playbooks
How do you install the skill?
Download the ZIP file from this page and unzip it. You can install the skill in one of two ways. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Either way, the folder should contain SKILL.md at its top level.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into .claude/skills/ inside your project
- Claude apps: upload under Settings → Capabilities → Skills
~/.claude/skills/What does the skill need before you run it?
The bundled scripts require Python 3. The process.py script lists optional pip packages, requests and jinja2. Access to a ticketing or SIEM system is optional. The skill's examples reference TheHive or ServiceNow, Jira and Splunk, and the curl commands need API tokens for those systems.
The skill also expects some preparation from you: the incident must be fully resolved, the timeline and documentation should be gathered, and the responders should be available for the review session.
- Python 3 for the bundled scripts
- Optional: pip packages requests and jinja2 (listed in process.py)
- Optional: access to TheHive or ServiceNow, Jira and Splunk or Elastic, each with an API token if you use the curl commands
- A resolved incident with timeline data and responders available
pip install requests jinja2How do you trigger the skill with a natural request?
You do not need a special command. Describe the task in plain language that mentions a review, post-mortem or lessons learned after an incident, and include the incident ID or the data you have. The agent should match the request to the skill from its description.
Be specific about the output you want. A request that names the artefact, such as meeting minutes or a metrics report, usually gets a more useful result than a general request.
- "Run a post-incident lessons learned review for IR-2024-042. The incident is resolved. Build the timeline from the attached export."
- "Calculate MTTD, MTTC and MTTR from these timestamps and flag any gaps larger than 30 minutes."
- "Draft a blameless post-mortem agenda and meeting minutes for last month's phishing incident."
- "Do a 5 Whys root cause analysis on the service account compromise and list action items with owners."
What output should you expect?
The skill's output format lists meeting minutes, a root cause analysis document, an incident metrics report, an action items list with owners and deadlines, updated IR playbooks and detection rules, and an executive summary. The bundled assets/template.md provides a report structure with an incident information table, a response metrics table with targets, and a timeline table.
The metric definitions in the skill are: MTTD is time from compromise to detection in the Key Concepts table, while the template and API reference define MTTD and MTTC from detection points. Check which definition your team uses before comparing results across reports.
- Meeting minutes and a root cause analysis document
- Incident metrics report with MTTD, MTTC and MTTR
- Action items with owners and deadlines
- Updated playbooks, detection rules and an executive summary
What are the safety notes for scripts and network calls?
This skill runs scripts and uses the network. The scripts in scripts/ (agent.py and process.py) contain hard-coded example data and placeholder internal URLs such as thehive.local and jira.local. Replace these with your own systems before running anything. The curl examples send API tokens in headers, so keep tokens in environment variables and do not paste them into shared notes.
Read the scripts before running them, and test against sample data first. The Jira example creates real issues when run against a live instance, so confirm the project key and assignee are correct.
- Adapt placeholder URLs and hard-coded example data before use
- Keep API tokens in environment variables, not in files you share
- Read scripts before running; test with sample data first
- Be aware that the curl examples create or read records in live systems
What tips help the results?
Give the agent complete, accurate timestamps in one consistent format and timezone. The metric calculations depend entirely on those values. The bundled Python example uses the format YYYY-MM-DD HH:MM:SS and shows how each metric is a difference between two events.
Use the 5 Whys section as a starting point, not a final answer. The example in the skill traces ransomware to a Kerberoasted service account and then to missing privileged access management, but your incident will need its own chain of evidence.
- Use one timestamp format and timezone across all sources
- Verify each why in the 5 Whys chain against evidence
- Keep the blameless principles: focus on systems and processes, not individuals
- Adapt the template targets to your own organisation's standards before comparing results
What people use it for
- Running a 90-minute blameless post-mortem after a ransomware incident, using the agenda in SKILL.md
- Calculating MTTD, MTTC and MTTR from timestamps exported from a case management system
- Producing a 5 Whys root cause document for a compromised service account
- Drafting action items and updated playbook notes after a phishing campaign review
- Creating an after-action report for students learning how incident response metrics are calculated
Frequently asked questions
How do I install the conducting-post-incident-lessons-learned skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project. In the Claude apps, you can instead upload it under Settings → Capabilities → Skills.
What do I need to run this skill?
Python 3 is needed for the bundled scripts. The optional pip packages are requests and jinja2, listed in process.py. API access to TheHive or ServiceNow, Jira and Splunk or Elastic is optional and only needed for the curl examples.
Is the skill free to use?
The skill is licensed under Apache-2.0, as stated on this page. Check the licence file in the download for the full terms.
Can I use this skill for an incident that is still active?
No. The skill assumes the incident is fully resolved, with containment, eradication and recovery complete. Running a review during an active incident could distract responders.
Will the scripts work out of the box with my systems?
Not without changes. The scripts contain hard-coded example data and placeholder internal URLs such as thehive.local and jira.local, which must be adapted to your environment before use.
How does this compare with an actual ticketing or SIEM tool?
This skill guides an AI agent through the review process and drafts outputs. It is not a turnkey incident management platform, and the source describes it as needing adaptation before use with your own TheHive, Jira or Splunk setup.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits security incident response teams, engineers and managers who want a consistent template and an agent to draft post-incident reviews, metrics and action items, and students learning MTTD and MTTR. It is a poor fit for active incidents, or for anyone expecting a ready-made tool, since the scripts need placeholder URLs and example data replaced before use.
Download the skill