Skill UI

Designs NIST SP 800-61r3/SANS PICERL-aligned incident response playbooks covering metadata, decision trees, escalation criteria, RACI roles, SOAR integrations, and technical containment procedures for repeatable response operations.

Creates OT-specific incident response playbooks aligned with SANS PICERL, IEC 62443, and NIST SP 800-82 to coordinate IT SOC, OT engineers, and plant ops during ICS ransomware or safety incidents.

Guides SOC analysts through initial triage of SIEM/EDR alerts using NIST SP 800-61r3 and SANS PICERL, classifying incidents, assessing severity via impact matrices, enriching with threat and asset context, and escalating to the right response team with containment steps.