Skill UI

Designs NIST SP 800-61r3/SANS PICERL-aligned incident response playbooks covering metadata, decision trees, escalation criteria, RACI roles, SOAR integrations, and technical containment procedures for repeatable response operations.

Guides SOC analysts through initial triage of SIEM/EDR alerts using NIST SP 800-61r3 and SANS PICERL, classifying incidents, assessing severity via impact matrices, enriching with threat and asset context, and escalating to the right response team with containment steps.