Skip to content
Get packs

Containing Active Breaches

Guides an agent through stopping live intrusions: isolating hosts, blocking C2, disabling accounts, preserving evidence.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When a confirmed, active security breach is underway, this skill tells the AI agent how to respond in a structured way: map which machines and accounts are compromised, isolate infected endpoints, block attacker command-and-control addresses, disable or reset compromised credentials, and capture forensic evidence before changes are made. It also includes a Python helper script that can run firewall-blocking and Active Directory account-disabling commands on a system.

Great for

  • Incident responders and SOC analysts who need a checklist-style playbook during a live incident
  • Security teams drafting or testing their containment runbooks
  • Students learning how real-world breach containment is sequenced

Skip it if

  • Post-incident cleanup after the attacker is gone; the skill itself says to use eradication procedures instead. Following containment steps then could cause unnecessary disruption.
  • Unconfirmed alerts or unauthorized environments: running blocking, disabling, or KRBTGT-reset actions without pre-approved authority can cause outages or legal exposure.
  • Anyone without administrative access to the EDR, firewall, and Active Directory, since the steps cannot be executed without it.

Try asking

  • “We have confirmed ransomware spreading from WKSTN-042. Help me build a containment plan that doesn't destroy evidence.”
  • “Map the lateral movement paths from these Windows 4624 Type 3 and Type 10 logs and list the accounts I should disable.”
  • “Draft a short-term and long-term containment status update for our incident commander.”
  • “Walk me through whether we need to double-reset the KRBTGT password after domain admin was compromised.”
Step-by-step guide: how to use Containing Active BreachesInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    containing-active-breach.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip containing-active-breach.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip containing-active-breach.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review every command before the agent runs it; the script executes real iptables and PowerShell changes against the system it runs on, so test in a lab first.
  • Confirm pre-approved containment authority and preserve memory and logs before any blocking or disabling actions.
  • Treat the output as a checklist to adapt to your environment, not as authoritative guidance; have a qualified incident responder validate it.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.