Investigate suspected compromise, preserve incident evidence, build a timeline and plan containment, recovery and verification. Use for incident response, account takeover, suspicious host activity or recovery after an attack.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Incident Response
## Workflow
1. Record incident scope, time window, source systems, owner, and observed impact. Separate confirmed evidence from hypotheses.
2. Preserve volatile observations and exported logs in a case directory; use hashes and collection timestamps. Read the acquisition example before collecting.
3. Correlate identities, hosts and time; record clock skew and missing evidence. Do not treat an empty log as proof of no activity.
4. Propose containment with concrete target, expected service impact and rollback. Execute changes only within the user's authorized scope; preserve recoverable access.
5. Remove the confirmed cause, restore from validated state, rotate affected credentials where indicated, and monitor for recurrence.
6. Verify normal service and the previously abused path; document evidence gaps and follow-up owners.
## Worked example and prerequisites
…
The line at the top of this page pins the label v1.0.200, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_eprkor3t2enbcfkj
GET https://markdownregistry.com/api/v1/resolve?ref=miosa-osa/osa/incident-response
GET https://markdownregistry.com/api/v1/blob/3e6f607eeada2e64d5f73ec3d4af0a9df2dc84e9693e0fbac300c65985e01f64
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
miosa-osa/osa · examples/skills/meeting-prep/SKILL.md · Research attendees, prepare talking points, and summarize previous interactions before meetings
cbrock84/headcount · plugins/security/skills/incident-response/SKILL.md · Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review…
rampstackco/claude-skills · skills/incident-response/SKILL.md · Manage active production incidents through detection, triage, mitigation, communication, and resolution with structured…
hypnguyen1209/offensive-claude · skills/incident-response/SKILL.md · Use when responding to or forensically investigating an incident — triage acquisition (Velociraptor/KAPE), Volatility 3…
stbenjam/skillsaw · tests/fixtures/apm/clean/.apm/skills/incident-response/SKILL.md · Triage and respond to production incidents. Use when handling an outage.
nahid-sparktales/agent-dispatcher · skills/devops/incident-response/SKILL.md · Stabilize a system that is failing right now — name the signal that flagged it, size the blast radius in numbers, keep…
