commit 521969080784a6c69b095c6b94d76ca3dbff923f Author: Zhongwei Li Date: Sun Nov 30 08:22:32 2025 +0800 Initial commit diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json new file mode 100644 index 0000000..eedfffc --- /dev/null +++ b/.claude-plugin/plugin.json @@ -0,0 +1,15 @@ +{ + "name": "security-incident-responder", + "description": "Assist with security incident response", + "version": "1.0.0", + "author": { + "name": "Jeremy Longshore", + "email": "[email protected]" + }, + "skills": [ + "./skills" + ], + "commands": [ + "./commands" + ] +} \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..1778229 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# security-incident-responder + +Assist with security incident response diff --git a/commands/incident-response.md b/commands/incident-response.md new file mode 100644 index 0000000..205880e --- /dev/null +++ b/commands/incident-response.md @@ -0,0 +1,8 @@ +--- +description: DESCRIPTION_PLACEHOLDER +shortcut: SHORTCUT_PLACEHOLDER +--- + +# TITLE_PLACEHOLDER + +CONTENT_PLACEHOLDER diff --git a/plugin.lock.json b/plugin.lock.json new file mode 100644 index 0000000..3cf4ac4 --- /dev/null +++ b/plugin.lock.json @@ -0,0 +1,61 @@ +{ + "$schema": "internal://schemas/plugin.lock.v1.json", + "pluginId": "gh:jeremylongshore/claude-code-plugins-plus:plugins/security/security-incident-responder", + "normalized": { + "repo": null, + "ref": "refs/tags/v20251128.0", + "commit": "0f7bf9ea39eadb9cd418cdeae345f137da92381d", + "treeHash": "edf5d1a08fef8790d3c25a7602e4f9e8ea9441b9c5c2fc4a21558bbf9a464510", + "generatedAt": "2025-11-28T10:18:44.183034Z", + "toolVersion": "publish_plugins.py@0.2.0" + }, + "origin": { + "remote": "git@github.com:zhongweili/42plugin-data.git", + "branch": "master", + "commit": "aa1497ed0949fd50e99e70d6324a29c5b34f9390", + "repoRoot": "/Users/zhongweili/projects/openmind/42plugin-data" + }, + "manifest": { + "name": "security-incident-responder", + "description": "Assist with security incident response", + "version": "1.0.0" + }, + "content": { + "files": [ + { + "path": "README.md", + "sha256": "596e0fbccf649ac8f904bdffd32c1ea6af8ffa19d1efc83dab82c4f83bf53ef7" + }, + { + "path": ".claude-plugin/plugin.json", + "sha256": "2d95f0598c4e9809ae525418df1f5a7e7cb0da79942ae424b365c9e8f5b6e62f" + }, + { + "path": "commands/incident-response.md", + "sha256": "26981dafecd0bda9d89082c091325c9fdc3ac197318243e952dde0b1a38f4088" + }, + { + "path": "skills/security-incident-responder/SKILL.md", + "sha256": "250e213abd49efe8dafe7078198df96f3ace3c02fa72c4fe2f3505961cbfac76" + }, + { + "path": "skills/security-incident-responder/references/README.md", + "sha256": "6d7364b53b02dbcdcf2ca93eed0306d8db561071a0cd34c615304986dec3adc1" + }, + { + "path": "skills/security-incident-responder/scripts/README.md", + "sha256": "1c32f2f95f6f962103bd406eee2c78c58e005c4d9f44b32d1d44852081fbe773" + }, + { + "path": "skills/security-incident-responder/assets/README.md", + "sha256": "54e48250d6938d29bf1d319ac8f24a34888f87ea22f3971a5cc8d9085a6a1db2" + } + ], + "dirSha256": "edf5d1a08fef8790d3c25a7602e4f9e8ea9441b9c5c2fc4a21558bbf9a464510" + }, + "security": { + "scannedAt": null, + "scannerVersion": null, + "flags": [] + } +} \ No newline at end of file diff --git a/skills/security-incident-responder/SKILL.md b/skills/security-incident-responder/SKILL.md new file mode 100644 index 0000000..fcf6a7e --- /dev/null +++ b/skills/security-incident-responder/SKILL.md @@ -0,0 +1,55 @@ +--- +name: responding-to-security-incidents +description: | + Assists with security incident response, investigation, and remediation. This skill is triggered when the user requests help with incident response, mentions specific incident types (e.g., data breach, ransomware, DDoS), or uses terms like "incident response plan", "containment", "eradication", or "post-incident activity". It guides the user through the incident response lifecycle, from preparation to post-incident analysis. It is useful for classifying incidents, creating response playbooks, collecting evidence, constructing timelines, and generating remediation steps. Use this skill when needing to respond to a "security incident". +allowed-tools: Read, Write, Edit, Grep, Glob, Bash +version: 1.0.0 +--- + +## Overview + +This skill empowers Claude to guide you through the security incident response process, ensuring a structured and effective approach to handling security breaches and attacks. It helps you classify incidents, develop response strategies, gather crucial evidence, and implement remediation steps to minimize damage and prevent future occurrences. + +## How It Works + +1. **Incident Classification**: Analyzes the incident details to determine the type, severity, and scope of the security event. +2. **Playbook Generation**: Creates a tailored response playbook based on the incident classification, outlining the necessary steps for containment, eradication, and recovery. +3. **Evidence Gathering**: Provides guidance on collecting relevant logs, network data, and forensic evidence to support the investigation. +4. **Remediation Planning**: Develops a detailed plan for remediating the vulnerabilities exploited during the incident and restoring affected systems. + +## When to Use This Skill + +This skill activates when you need to: +- Respond to a suspected security breach or attack. +- Develop an incident response plan. +- Investigate a security incident and gather evidence. +- Remediate vulnerabilities exploited during a security incident. +- Generate a post-incident report and lessons learned. + +## Examples + +### Example 1: Responding to a Ransomware Attack + +User request: "We've been hit with a ransomware attack. What should we do?" + +The skill will: +1. Classify the incident as a ransomware attack. +2. Generate a response playbook including steps for containment (isolating affected systems), eradication (removing the ransomware), and recovery (restoring from backups). + +### Example 2: Investigating a Data Breach + +User request: "Investigate a potential data breach on our customer database." + +The skill will: +1. Provide guidance on collecting evidence such as database logs, network traffic, and application logs. +2. Help construct a timeline of events to identify the attack vector and scope of the breach. + +## Best Practices + +- **Prioritization**: Focus on containing the incident first to prevent further damage. +- **Evidence Preservation**: Carefully preserve all evidence to support the investigation and potential legal action. +- **Communication**: Maintain clear and consistent communication with stakeholders throughout the incident response process. + +## Integration + +This skill can be integrated with other security tools and plugins to automate tasks such as vulnerability scanning, log analysis, and threat intelligence gathering. It can also be used in conjunction with project management tools to track incident response tasks and assign responsibilities. \ No newline at end of file diff --git a/skills/security-incident-responder/assets/README.md b/skills/security-incident-responder/assets/README.md new file mode 100644 index 0000000..ee4ffb4 --- /dev/null +++ b/skills/security-incident-responder/assets/README.md @@ -0,0 +1,7 @@ +# Assets + +Bundled resources for security-incident-responder skill + +- [ ] incident_report_template.docx: Template for creating post-incident reports. +- [ ] communication_templates.txt: Pre-written email and message templates for communicating with stakeholders during an incident. +- [ ] severity_matrix.csv: Matrix for assessing the severity of security incidents. diff --git a/skills/security-incident-responder/references/README.md b/skills/security-incident-responder/references/README.md new file mode 100644 index 0000000..2f0ccd9 --- /dev/null +++ b/skills/security-incident-responder/references/README.md @@ -0,0 +1,7 @@ +# References + +Bundled resources for security-incident-responder skill + +- [ ] nist_incident_response_guide.md: Excerpt of NIST incident response guide with relevant sections. +- [ ] owasp_top_10.md: OWASP Top 10 vulnerabilities and remediation steps. +- [ ] common_incident_playbooks.md: Pre-defined playbooks for common incident types (e.g., ransomware, data breach). diff --git a/skills/security-incident-responder/scripts/README.md b/skills/security-incident-responder/scripts/README.md new file mode 100644 index 0000000..e4f27a5 --- /dev/null +++ b/skills/security-incident-responder/scripts/README.md @@ -0,0 +1,7 @@ +# Scripts + +Bundled resources for security-incident-responder skill + +- [ ] incident_classifier.py: Classifies the type of security incident based on keywords and context. +- [ ] evidence_collector.sh: Automates the collection of forensic evidence from affected systems. +- [ ] timeline_builder.py: Creates a timeline of events based on logs and other data sources.