Skill UI

Designs NIST SP 800-61r3/SANS PICERL-aligned incident response playbooks covering metadata, decision trees, escalation criteria, RACI roles, SOAR integrations, and technical containment procedures for repeatable response operations.

Creates a structured SOC ransomware response playbook with detection queries, triage decision trees, containment APIs, and evidence collection tied to NIST SP 800-61 and MITRE ATT&CK so teams can rehearse consistent procedures.

Guides SOC analysts through initial triage of SIEM/EDR alerts using NIST SP 800-61r3 and SANS PICERL, classifying incidents, assessing severity via impact matrices, enriching with threat and asset context, and escalating to the right response team with containment steps.