Skip to content
Get packs

Cloud Incident Response

Guides an agent through containing and investigating AWS, Azure, and GCP security incidents.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, the agent follows a structured cloud incident response playbook for AWS, Azure, and GCP. It helps triage suspicious cloud logs (such as CloudTrail, Azure Activity Logs, and GCP Audit Logs), lock down compromised credentials and resources, preserve forensic evidence before it is lost, and plan cleanup and recovery. It also includes a Python helper script that can run AWS CLI commands to disable access keys, attach a deny-all policy, and isolate instances.

Great for

  • Security engineers or cloud admins responding to a suspected account or credential compromise
  • Teams that want a checklist of provider-specific containment and evidence steps
  • Students learning how cloud incident response differs from on-premises response

Skip it if

  • Purely on-premises incidents with no cloud component, which the skill itself says should use standard IR procedures
  • Live production incidents run unreviewed: the commands change IAM permissions and can lock out legitimate users or break services if pasted without checking identifiers and scope
  • Non-experts without cloud admin access, since the steps need privileged accounts and familiarity with the provider consoles

Try asking

  • “A CloudTrail alert shows CreateAccessKey on an existing IAM user from an unknown IP. Walk me through containment.”
  • “Our Azure Activity Log shows a new Owner role assignment on a service principal. What evidence should I export first?”
  • “Help me check whether an EC2 instance was used to steal IMDS credentials and make API calls from outside.”
  • “Create a post-incident checklist for a GCP project where SetIamPolicy granted allUsers access to a bucket.”
Step-by-step guide: how to use Cloud Incident ResponseInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    conducting-cloud-incident-response.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-cloud-incident-response.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-cloud-incident-response.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review every identifier (user names, access key IDs, instance IDs, resource groups) and confirm scope before letting the agent run any containment command.
  • Export and preserve logs and disk snapshots before containment changes, since ephemeral resources and log retention windows can end the evidence.
  • Ask the agent to dry-run or explain each command first, and keep a human approver for destructive or access-changing actions.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.