Incident Response Playbook Builder
Designs structured incident response playbooks with steps, decision trees, escalation and RACI tables
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent helps a security team write incident response playbooks: step-by-step procedures for specific incident types such as ransomware, phishing, or data breaches. It can produce decision trees, escalation criteria, role assignment (RACI) tables, and outlines for automating steps in a SOAR platform, following the NIST SP 800-61r3 and SANS PICERL frameworks. It also includes a Python helper script that holds template content for several playbook types.
Great for
- Security teams building or maturing an incident response program
- Analysts documenting a runbook for a new attack type after an incident
- Teams preparing documented IR procedures for audits such as SOC 2 or PCI-DSS
Skip it if
- Live incident handling or one-time investigations, since the skill is for reusable procedure documents (the skill says so itself)
- Organizations that treat generated procedures as final without review by experienced responders, because example commands and tool steps may not match their environment
Try asking
- “Create an incident response playbook for ransomware that covers detection, containment, eradication, recovery and communication”
- “Draft a phishing and credential compromise playbook with a severity decision tree”
- “Write a RACI matrix for our incident response team roles”
- “Outline which steps of a business email compromise playbook could be automated in Splunk SOAR”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
building-incident-response-playbook.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-incident-response-playbook.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-incident-response-playbook.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Scope each playbook to a single incident type and check the generated steps against your own risk assessment and tool stack
- Replace example hostnames, IPs and vendor console steps with your real environment details before use
- Review the script's network calls and the requests dependency before running it, since the file excerpt shown does not reveal everything it does
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.