Skip to content
Get packs

Post-Incident Lessons Learned

Run structured, blameless reviews after security incidents and turn findings into action items

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill guides an AI agent through a structured review after a cybersecurity incident has been resolved. The agent helps reconstruct the timeline, run a blameless post-mortem meeting agenda, perform root cause analysis such as 5 Whys, calculate response metrics like time to detect, contain and recover, and draft outputs such as meeting minutes, action items and updated playbooks. It also includes sample scripts that compute these metrics from timeline data and flag large gaps between response steps.

Great for

  • Security incident response teams running post-incident reviews
  • Engineers or managers who need a consistent template for after-action reports
  • Students learning how incident response metrics like MTTD and MTTR are calculated

Skip it if

  • Active incidents that are not yet contained or recovered, because the skill assumes the incident is fully resolved and the review should not distract responders
  • Organisations expecting a turnkey tool, since the scripts contain hard-coded example data and placeholder internal URLs (such as thehive.local and jira.local) that must be adapted before use

Try asking

  • “Help me run a blameless post-mortem for last week's ransomware incident using this timeline”
  • “Calculate MTTD, MTTC and MTTR from these incident timestamps and flag any response gaps over 30 minutes”
  • “Draft a root cause analysis using the 5 Whys for a phishing compromise and suggest action items”
  • “Write an executive summary and updated playbook recommendations from our tabletop exercise notes”
Step-by-step guide: how to use Post-Incident Lessons LearnedInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    conducting-post-incident-lessons-learned.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-post-incident-lessons-learned.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-post-incident-lessons-learned.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Give the agent exported timeline data with consistent timestamp formats, since the scripts expect ISO-style timestamps and will fail or misreport otherwise
  • Review any curl or Jira commands before running them, and store API tokens in environment variables rather than pasting them into chat
  • Treat the example incident values and Sigma rule in the skill as illustrations and replace them with your own findings

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.