'incident' 검색 결과

Assess detected security events by checking false positives, assigning incident types and severity levels, and identifying escalation routes. Guide initial response and forensic evidence collection, including records of who collected, held, and transferred each evidence item.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Classifying security alerts during initial response
• Checking false positives before escalation
• Planning evidence collection and custody records

Preserve lessons from production incidents and near misses in a timestamped ledger. Consult relevant entries before database or release changes, and record each new lesson with a concrete rule and a test or automated check.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review incident lessons before database changes
• Check past release failures before deployment
• Record lessons after resolving an incident

Hunt for signs of compromise in web and application logs without an initial alert. Establish normal activity, record investigative hypotheses, check source code, and reproduce issues locally before producing incident records and a report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for compromise without an initial alert
• Tracing related activity across application logs
• Distinguishing attack attempts from successful exploitation

Automatic init the first time Claude acts in an incident or alerts channel — one named like #inc-…, #incident-…, #sev0-…/#sev1-…, or whose recent messages are pages or alerts from PagerDuty, Opsgenie, incident.io, Datadog, Sentry or Grafana, or relayed by people (talk about being paged is not an alert) — that isn't already a team's oncall / monitoring channel. Run once per channel, on first contact (just invited, first @-mention, channel just created), before doing what was asked: load the oncall memory oncall setup wrote to shared workspace memory, pick the owning team's section, work out which monitoring / paging / code tools Claude can reach and which are missing, post one short zero-context message, note findings in this channel's memory, then hand off to `incident-investigate` if something was asked — or immediately, unasked, when the channel was plainly opened for a live outage. Works with no oncall memory (offers setup once). Also on "load the oncall setup here" / "init this incident".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when working with Allma — allma incident management, collaboration workflows, post-incident learning, and channel orchestration. Covers incident creation via Slack, timeline tracking, stakeholder communication, automated workflows, and retrospective analysis. Use when managing active incidents, reviewing post-incident learnings, or analyzing incident patterns in Allma.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create incident response runbooks with ordered recovery steps, severity levels, escalation contacts, and status update templates. Help on-call engineers follow clear procedures during outages, verify recovery, and keep stakeholders informed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Writing a payment service outage runbook
• Documenting database incident recovery
• Preparing guides for new on-call engineers

Create a structured review after a production incident, focusing on systems and processes without blaming individuals. Reconstruct events, quantify impact, investigate causes, and document specific follow-up actions with named owners and deadlines.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Write a review after a production outage
• Reconstruct an incident timeline from records
• Separate root causes from contributing factors

Connect security incidents across organizations by comparing attack indicators, techniques, and timelines. Build relationship graphs and campaign reports that document shared evidence, attribution confidence, and indicators useful for detection.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Linking incidents that share attack indicators
• Analyzing attacks across partner organizations
• Preparing reports on sustained attack campaigns

Create a ransomware response playbook aligned with CISA guidance and NIST CSF, a cybersecurity framework. Organize preparation, detection, containment, recovery, and lessons learned into actionable checklists for readiness reviews and simulated incident exercises.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating or updating a ransomware response playbook
• Assessing readiness against CISA guidance
• Validating response steps in a tabletop exercise

Build a ransomware response playbook for security monitoring teams, covering detection, containment, eradication, and recovery. Include log queries, decision trees, evidence collection, backup restoration, and incident reviews to prepare consistent procedures before an attack occurs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating a standardized ransomware response playbook
• Documenting host isolation and recovery procedures
• Addressing coordination gaps found in tabletop exercises

Respond to security incidents across AWS, Azure, and GCP by investigating audit logs, containing compromised identities, isolating resources, and preserving evidence. Organize recovery and follow-up security measures for credential leaks, unauthorized permission changes, and attacks spanning cloud services.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Responding to leaked cloud credentials
• Investigating unauthorized permission or resource changes
• Preserving audit logs and disk snapshots

Investigate a possible incident in Superset’s hosted services by checking deployments, error spikes, and service health. Produce a proposed severity and status page update for human review, without changing services or publishing messages.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating a reported Superset outage
• Checking the scope of a sudden increase in errors
• Drafting an incident severity and status page update

Triage, contain, recover, and review Adobe auth, product, async-job, event, storage, spend, or App Builder incidents with evidence. Use when the task requires adobe integration incident command. Trigger with "Adobe incident", "Firefly outage", or "Adobe credential leak".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert SRE incident responder specializing in rapid problem resolution, modern observability, and comprehensive incident management. Masters incident command, blameless post-mortems, error budget management, and system reliability patterns. Handles critical outages, communication strategies, and continuous improvement. Use IMMEDIATELY for production incidents or SRE practices.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run a blameless postmortem for an incident caused by an AI agent or LLM feature — hallucinated facts shipped to users, runaway tool use, prompt injection, cost blowouts, or wrong actions taken autonomously. Use when asked to write up an AI incident, analyse why an agent did something wrong, or produce corrective actions after an LLM failure. Produces a structured postmortem with trace reconstruction, a root-cause layer analysis, and corrective actions including a permanent regression case. For non-AI production incidents use incident-postmortem.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Assess, report, and manage serious incidents involving high-risk AI systems under Article 73 EU AI Act. Covers incident qualification, deadline buckets (2/10/15 days), authority notification, deployer duties (Art. 26(5)), cross-regulation mapping (GDPR/NIS2/MDR), corrective measures, and DACH-specific routing. Use when asked to evaluate whether an AI incident is reportable, draft an Article 73 notification, identify the right authority, or build an AI incident response process.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Use when: (1) User reports a data breach or security incident — including "is this even a personal data breach?" triage, (2) User asks about breach notification obligations or deadlines, (3) User mentions "72 hours", Art. 33, Art. 34, or notification requirements, (4) Discussion involves security incidents affecting personal data, (5) User needs breach risk assessment using ENISA methodology, (6) User mentions "Data Breach" or "Incident" or "Data Leakage" or "Ransomware" or "Exfiltration", (7) User needs to determine Controller vs Processor obligations, (8) Cross-border breach scenarios requiring Lead SA determination, (9) User needs a mitigation playbook or immediate response recommendations, (10) User needs audit-ready breach documentation (.docx) or an EDPB-template-aligned breach notification / evidence file — including follow-up and withdrawal notifications, (11) Breach involves an AI system requiring AI Act Art. 73 serious incident screening.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert in running effective incident postmortems. Covers blameless analysis, root cause investigation, action item prioritization, and building a learning culture. Understands that incidents are opportunities to improve systems, not punish people. Use when "postmortem, incident review, what went wrong, root cause, blameless, outage, post-incident, " mentioned.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Write a blameless postmortem after an incident. Use when the user says "postmortem", "post-incident review", "PIR", "what happened in that incident", "incident review", "blameless postmortem", "5 whys", "how do we prevent this again", or needs to document learnings from a production incident - even if they don't explicitly say "postmortem".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident review", "lessons learned", "retro on the outage", "blameless review", "root cause of the incident" or "what do we change after this breach". Builds the timeline from records before the meeting, runs a blameless discussion, finds the contributing factors, and turns them into a few owned, dated actions linked to updates of the risk register, controls, playbooks and supplier records, then writes the review and an action tracker.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when something is happening now: an alert, a suspicious login, a ransomware note, data sent to the wrong customer, an outage that might be an attack, and someone asks "how bad is this", "classify this incident", "is this a SEV1", "who do we wake up", "is this a breach", "do we need to notify anyone" or "start the incident log". Classifies the incident on the company's own scale in minutes, decides who is called and how fast, flags any regulatory or contractual clock, lists the evidence to preserve, and starts a timestamped triage record that is revisited as facts change.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.