Incident Response Plan

This gives you a structured framework for handling security incidents from detection through recovery. It includes Python dataclasses for tracking incident severity, status, and types, plus playbooks for common scenarios like data breaches, malware infections, and unauthorized access. The main value is in the predefined workflow states and enums that keep your response organized when things go sideways. You get reference implementations for both a general framework and Node.js specific detection patterns. Honestly most useful if you're building out incident response tooling or need a template to avoid reinventing the process during an actual breach.

skills.sh installs: 484
GitHub stars: 379
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aj-geddes/useful-ai-prompts --skill incident-response-plan --agent claude-code

Installs into .claude/skills of the current project.

Files

Overview

Structured approach to detecting, responding to, containing, and recovering from security incidents with comprehensive playbooks and automation.

When to Use

Security breach detection
Data breach response
Malware infection
DDoS attacks
Insider threats
Compliance violations
Post-incident analysis

Quick Start

Minimal working example:

# incident_response.py
from dataclasses import dataclass, field
from typing import List, Dict, Optional
from enum import Enum
from datetime import datetime
import json

class IncidentSeverity(Enum):
    CRITICAL = "critical"  # P1 - Business critical
    HIGH = "high"          # P2 - Major impact
    MEDIUM = "medium"      # P3 - Moderate impact
    LOW = "low"            # P4 - Minor impact

class IncidentStatus(Enum):
    DETECTED = "detected"
    INVESTIGATING = "investigating"
    CONTAINED = "contained"
    ERADICATED = "eradicated"
    RECOVERED = "recovered"
    CLOSED = "closed"

SKILL.md on GitHub