「post-incident」の検索結果

Implement layered collective defense using alarm signaling, role mobilization, and proportional response. Covers threat detection, alert propagation, immune response patterns, escalation tiers, and post-incident recovery for distributed systems and organizations. Use when designing defense-in-depth where no single guardian covers all threats, building incident response that scales with severity, or when current defense is over-reactive to every alert or under-reactive to genuine threats.

日本語の概要は準備中です。原文の説明を表示しています。

Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Write a blameless postmortem after an incident. Use when the user says "postmortem", "post-incident review", "PIR", "what happened in that incident", "incident review", "blameless postmortem", "5 whys", "how do we prevent this again", or needs to document learnings from a production incident - even if they don't explicitly say "postmortem".

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of a Media Technical Director/Manager — calling a live broadcast switcher and owning the technical readiness sign-off, designing router/path redundancy and PTP failover for an IP production, resolving a timecode or loudness compliance defect found in rehearsal, or running the post-incident review after an on-air technical failure.

日本語の概要は準備中です。原文の説明を表示しています。

Analyze an incident response program for playbook coverage, MTTR optimization opportunities, evidence collection readiness, root cause analysis quality, and post-incident review effectiveness. Triggers: building a SOC, assessing IR maturity, optimizing detection-to-recovery timelines.

日本語の概要は準備中です。原文の説明を表示しています。

Audit emergency and crisis triage systems for call prioritization accuracy, resource dispatching algorithm quality, severity classification model evaluation, response time optimization, geographic coverage analysis, mutual aid protocol readiness, and post-incident review workflows..

日本語の概要は準備中です。原文の説明を表示しています。

Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.

日本語の概要は準備中です。原文の説明を表示しています。

Turns an engineer's notes, a ticket history or a chat thread into a draft step-by-step runbook with preconditions, stop conditions, numbered steps with checks, verification, rollback and escalation, for the team to validate before use. Commands verbatim, placeholders marked, every gap UNKNOWN; never executes a step or fills a gap from general knowledge. Use when the user asks to "write a runbook from these notes", "turn this resolved ticket into a runbook", "document the steps we ran" or "check this runbook for gaps". Do not use for a business process without commands, use sop-drafter instead; for a knowledge article or known-error record, use knowledge-article-drafter; for the post-incident review, use incident-postmortem-drafter. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Drafts a blameless incident postmortem (summary, impact, timeline, detection and response, contributing factors as candidates for review, action items) from an incident channel export, ticket notes and any alert or change records, with UNKNOWN for every fact the inputs do not contain. Never assigns blame, names a root cause or re-rates severity. Use when the user asks to "write the postmortem for this incident", "build the incident timeline from the chat export", "draft the post-incident review" or "turn this ticket and channel log into an incident report". Do not use for a knowledge article from the resolved ticket, use knowledge-article-drafter instead; for project retrospectives, use lessons-learned-synthesis; for data-breach impact and notification questions, use data-incident-impact-brief. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Drafts one knowledge article or known-error article from a resolved incident or ticket thread: symptoms as reported, environment, cause exactly as the resolver stated it, resolution steps as performed, workaround with its limits, verification, things tried without effect, related records, keywords and proposed metadata, every statement traced to a ticket note or marked UNKNOWN, with a redaction log and a question list for the knowledge owner. Never decides a root cause, adds a step or publishes. Use when the user asks to "write a KB article from this ticket", "turn this resolved incident into a knowledge article", "draft a known error record for this", "document the fix we just did" or "make this thread into a how-to for the service desk". Do not use for a procedure the team will execute (runbook, operating procedure, playbook), use runbook-drafter instead; for a post-incident review, use incident-postmortem-drafter. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks to "build our social crisis protocol", "mentions are exploding — what do we do first", or "when do we pause the posting queue"; produces a 1-5 severity ladder with tunable Estimated trigger thresholds (mention-velocity multiples vs the 7-day listening baseline, sentiment flip, journalist/regulator contact, employee-conduct class), the first-mechanical-action rule — pause ALL scheduled posts AND paid amplification, with dated state markers dropped to the channels proposal protocol and reconciled post-incident — a pre-approved holding-statement library with committed update cadences, when-NOT-to-post rules, a spokesperson/approval matrix, and a post-crisis retro template; re-runs the social-quality-auditor pre-publish gate before un-pausing the queue. Not for email deliverability incidents (blocklist, spam-rate spikes) — use deliverability-qa; inside a launch window launch-day-conductor owns incident handling. 社媒危机预案/暂停队列/声明库/发言人矩阵

日本語の概要は準備中です。原文の説明を表示しています。

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a safety director, operations manager, or fleet owner asks for templates, topics, or structure for recurring safety meetings — weekly driver meetings, monthly safety committee meetings, quarterly all-hands safety reviews, or post-incident safety stand-downs.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a structured ransomware incident response playbook aligned with the CISA StopRansomware Guide and NIST Cybersecurity Framework. Covers preparation, detection, containment, eradication, recovery, and post-incident phases with actionable checklists. Activates for requests involving ransomware response planning, CISA compliance, incident response playbook creation, or ransomware preparedness assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have interrupted the attack at earlier phases. Use when conducting post-incident analysis, building prevention-focused security controls, or mapping detection gaps to kill chain phases. Activates for requests involving kill chain analysis, intrusion kill chain, attack phase mapping, or Lockheed Martin kill chain framework.

日本語の概要は準備中です。原文の説明を表示しています。

Conduct Critical Decision Method (CDM) interviews to elicit expert reasoning strategies (L3 knowledge) from practitioners about specific challenging past incidents. Use when capturing expertise for skill development, preserving knowledge before practitioner departure, building post-incident learning artifacts, or investigating decisions in complex sociotechnical systems. Outputs structured incident reconstructions with cues, decisions, alternatives considered, and counterfactual analysis suitable for distillation into skills or training material.

日本語の概要は準備中です。原文の説明を表示しています。