triaging-security-incident-with-ir-playbook
Classifies and prioritizes security incidents using structured IR playbooks and SIEM/case-management queries (Splunk, TheHive) to determine severity, assign response teams, and initiate the appropriate response procedures. Use when a new SOC alert needs triage, multiple concurrent incidents require prioritization, or automated triage rules need validation or tuning.
SKILL.md
The description above is the indexed summary. With JavaScript enabled, this page also loads the SKILL.md text from GitHub.