incident-response-playbook-creator

What this skill does

# Incident Response Playbook Creator

**Version**: 2.2.0
**Category**: Security
**Author**: Diego Consolini

---

## Overview

This skill generates comprehensive, customized incident response playbooks based on authoritative templates from **NIST SP 800-61r3** (April 2025), **CISA** guidance, and specialized NIST publications (SP 800-161r1, SP 800-190, SP 800-82r3, SP 800-218). It creates professional, ready-to-use playbooks for 11 different incident scenarios with built-in GDPR and HIPAA compliance considerations.

### What This Skill Does

- ✅ Generates complete incident response playbooks in Markdown format
- ✅ Includes detection indicators, response procedures, recovery actions, and communication templates
- ✅ Incorporates NIST CSF 2.0 alignment and compliance requirements (GDPR, HIPAA)
- ✅ Customizes playbooks for specific organizations and industries
- ✅ Provides role-based responsibilities and escalation procedures
- ✅ Based on 100% real, authoritative content (no mock data)

### Available Incident Scenarios (11 Total)

**Traditional Attacks:**
1. **Ransomware Attack** (Critical)
2. **Data Breach / Exfiltration** (Critical)
3. **Phishing / Business Email Compromise** (High)

**Modern Attack Vectors:**
4. **AI/ML Security Incident** (High)
5. **Supply Chain Attack** (Critical)
6. **Container/Kubernetes Security Incident** (High)

**Critical Infrastructure & Cloud:**
7. **IoT/OT Security Incident** (Critical)
8. **Cloud Security Breach** (Critical)
9. **API Security Incident** (High)

**Insider & Availability Threats:**
10. **Insider Threat** (Critical)
11. **DDoS Attack** (High)

---

## When to Use This Skill

This skill should be activated when the user:

- Asks to create an incident response playbook
- Mentions they need IR documentation or procedures
- Asks about incident response for specific scenarios (ransomware, data breach, phishing, DDoS, etc.)
- Wants to prepare for security incidents
- Needs compliance-aligned incident response procedures
- Asks about NIST SP 800-61 or CISA incident response guidance

**Example Triggers**:

*Traditional Attacks:*
- "Create an incident response playbook for ransomware"
- "I need IR procedures for data breaches"
- "Generate incident response documentation"
- "Help me prepare for a phishing attack"

*Modern Attack Vectors:*
- "Create playbook for AI/ML security incidents"
- "I need response procedures for supply chain attacks"
- "Generate IR playbook for software supply chain compromise"
- "Help with container security incident response"
- "Kubernetes security breach procedures"
- "Docker security incident playbook"

*Critical Infrastructure & Cloud:*
- "IoT security incident response"
- "OT security breach procedures"
- "Industrial control system incident playbook"
- "SCADA security incident response"
- "Cloud security breach playbook"
- "S3 bucket breach incident response"
- "IAM compromise procedures"
- "API security incident playbook"
- "API vulnerability response procedures"

*Insider & Availability Threats:*
- "Insider threat response playbook"
- "Malicious insider incident procedures"
- "Employee data theft response"
- "DDoS attack incident response"
- "Denial of service attack playbook"

---

## How to Use This Skill

### Step 1: Browse Available Scenarios (Optional)

First, you can show the user what scenarios are available:

```bash
python3 scripts/browse_scenarios.py --list
```

This displays all available incident types with descriptions, severity levels, and compliance flags.

For detailed information about a specific scenario:

```bash
python3 scripts/browse_scenarios.py --detail ransomware
```

### Step 2: Collect Organization Information

Use the **AskUserQuestion** tool to collect the required information from the user. This provides a beautiful, user-friendly interface for gathering customization details.

**IMPORTANT**: Always use AskUserQuestion for gathering this information. Do NOT just ask in text.

#### Question 1: Incident Scenario Selection

Present scenarios in groups for better organization. You can use multiple questions or present options by category.

**Option A: Single Question with All Scenarios (11 options - use if user hasn't specified)**
```python
AskUserQuestion(questions=[
    {
        "question": "Which incident scenario do you need a playbook for?",
        "header": "Scenario",
        "multiSelect": false,
        "options": [
            {
                "label": "Ransomware Attack",
                "description": "Malware that encrypts files and demands payment. Critical severity, GDPR/HIPAA applicable."
            },
            {
                "label": "Data Breach",
                "description": "Unauthorized access and data theft. Critical severity, comprehensive compliance guidance."
            },
            {
                "label": "Phishing / BEC",
                "description": "Email-based social engineering and fraud. High severity."
            },
            {
                "label": "AI/ML Security",
                "description": "Adversarial attacks on machine learning models. High severity."
            },
            {
                "label": "Supply Chain Attack",
                "description": "Compromise through third-party software/services. Critical severity."
            },
            {
                "label": "Container/Kubernetes",
                "description": "Container escape or cluster compromise. High severity."
            },
            {
                "label": "IoT/OT Security",
                "description": "Industrial control systems and SCADA security. Critical severity."
            },
            {
                "label": "Cloud Breach",
                "description": "S3 exposure, IAM compromise, cloud misconfigurations. Critical severity."
            },
            {
                "label": "API Security",
                "description": "API vulnerabilities and data exposure. High severity."
            },
            {
                "label": "Insider Threat",
                "description": "Malicious or negligent insider actions. Critical severity."
            },
            {
                "label": "DDoS Attack",
                "description": "Distributed denial of service attacks. High severity."
            }
        ]
    }
])
```

**Option B: Category-Based Question (if user mentioned a category)**
```python
# If user mentioned "cloud" or "container" etc., show relevant options
AskUserQuestion(questions=[
    {
        "question": "Which modern attack scenario are you concerned about?",
        "header": "Scenario",
        "multiSelect": false,
        "options": [
            {
                "label": "AI/ML Security Incident",
                "description": "Model poisoning, adversarial attacks, inference manipulation"
            },
            {
                "label": "Supply Chain Attack",
                "description": "SolarWinds-style attacks, dependency vulnerabilities"
            },
            {
                "label": "Container/Kubernetes Security",
                "description": "Container escape, cluster compromise, orchestration attacks"
            }
        ]
    }
])
```

#### Question 2: Organization Information

```python
AskUserQuestion(questions=[
    {
        "question": "What is your organization name?",
        "header": "Organization",
        "multiSelect": false,
        "options": [
            {
                "label": "Provide name",
                "description": "Enter your organization's name for the playbook"
            }
        ]
    },
    {
        "question": "What industry sector are you in?",
        "header": "Industry",
        "multiSelect": false,
        "options": [
            {
                "label": "Healthcare",
                "description": "Medical, hospitals, healthcare providers (HIPAA applicable)"
            },
            {
                "label": "Finance",
                "description": "Banks, financial service