Browse Skills — Page 147

implementing-secret-scanning-with-gitleaks

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-secrets-management-with-vault

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-secrets-scanning-in-ci-cd

mukul975/Anthropic-Cybersecurity-Skills

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment

implementing-security-chaos-engineering

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-security-information-sharing-with-stix2

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-security-monitoring-with-datadog

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-semgrep-for-custom-sast-rules

mukul975/Anthropic-Cybersecurity-Skills

Write custom Semgrep SAST rules in YAML to detect application-specific vulnerabilities, enforce coding standards, and integrate into CI/CD pipelines.

implementing-siem-correlation-rules-for-apt

mukul975/Anthropic-Cybersecurity-Skills

>-

implementing-siem-use-case-tuning

mukul975/Anthropic-Cybersecurity-Skills

Tune SIEM detection rules to reduce false positives by analyzing alert volumes, creating whitelists, adjusting thresholds, and measuring detection efficacy metrics in Splunk and Elastic

implementing-siem-use-cases-for-detection

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-sigstore-for-software-signing

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-soar-automation-with-phantom

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-soar-playbook-for-phishing

mukul975/Anthropic-Cybersecurity-Skills

Automate phishing incident response using Splunk SOAR REST API to create containers, add artifacts, and trigger playbooks

implementing-soar-playbook-with-palo-alto-xsoar

mukul975/Anthropic-Cybersecurity-Skills

Implement automated incident response playbooks in Cortex XSOAR to orchestrate security workflows across SOC tools and reduce manual response time.

implementing-stix-taxii-feed-integration

mukul975/Anthropic-Cybersecurity-Skills

STIX (Structured Threat Information eXpression) and TAXII (Trusted Automated eXchange of Intelligence Information) are OASIS open standards for representing and transporting cyber threat intelligence.

implementing-supply-chain-security-with-in-toto

mukul975/Anthropic-Cybersecurity-Skills

Implement software supply chain integrity verification for container builds using the in-toto framework to create cryptographically signed attestations across CI/CD pipeline steps.

implementing-syslog-centralization-with-rsyslog

mukul975/Anthropic-Cybersecurity-Skills

>-

implementing-taxii-server-with-opentaxii

mukul975/Anthropic-Cybersecurity-Skills

Deploy and configure an OpenTAXII server to share and consume STIX-formatted cyber threat intelligence using the TAXII 2.1 protocol for automated indicator exchange between organizations.

implementing-threat-intelligence-lifecycle-management

mukul975/Anthropic-Cybersecurity-Skills

Implement a structured threat intelligence lifecycle encompassing planning, collection, processing, analysis, dissemination, and feedback stages to produce actionable intelligence for organizational decision-making.

implementing-threat-modeling-with-mitre-attack

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-ticketing-system-for-incidents

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-usb-device-control-policy

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-velociraptor-for-ir-collection

mukul975/Anthropic-Cybersecurity-Skills

Deploy and configure Velociraptor for scalable endpoint forensic artifact collection during incident response using VQL queries, hunts, and pre-built artifact packs across Windows, Linux, and macOS environments.

implementing-vulnerability-management-with-greenbone

mukul975/Anthropic-Cybersecurity-Skills

Deploy and operate Greenbone/OpenVAS vulnerability management using the python-gvm library to create scan targets, execute vulnerability scans, and parse scan reports via GMP protocol.

implementing-vulnerability-remediation-sla

mukul975/Anthropic-Cybersecurity-Skills

Vulnerability remediation SLAs define mandatory timeframes for patching or mitigating identified vulnerabilities based on severity, asset criticality, and exploit availability. Effective SLA programs

implementing-vulnerability-sla-breach-alerting

mukul975/Anthropic-Cybersecurity-Skills

Build automated alerting for vulnerability remediation SLA breaches with severity-based timelines, escalation workflows, and compliance reporting dashboards.

implementing-web-application-logging-with-modsecurity

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-zero-knowledge-proof-for-authentication

mukul975/Anthropic-Cybersecurity-Skills

Zero-Knowledge Proofs (ZKPs) allow a prover to demonstrate knowledge of a secret (such as a password or private key) without revealing the secret itself. This skill implements the Schnorr identificati

implementing-zero-standing-privilege-with-cyberark

mukul975/Anthropic-Cybersecurity-Skills

Deploy CyberArk Secure Cloud Access to eliminate standing privileges in hybrid and multi-cloud environments using just-in-time access with time, entitlement, and approval controls.

implementing-zero-trust-dns-with-nextdns

mukul975/Anthropic-Cybersecurity-Skills

Implement NextDNS as a zero trust DNS filtering layer with encrypted resolution, threat intelligence blocking, privacy protection, and organizational policy enforcement across all endpoints.

implementing-zero-trust-for-saas-applications

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-zero-trust-in-cloud

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-zero-trust-network-access

mukul975/Anthropic-Cybersecurity-Skills

>

implementing-zero-trust-network-access-with-zscaler

mukul975/Anthropic-Cybersecurity-Skills

Implement Zero Trust Network Access using Zscaler Private Access (ZPA) to replace traditional VPN with identity-based, context-aware access to private applications through the Zscaler Zero Trust Exchange.

implementing-zero-trust-with-beyondcorp

mukul975/Anthropic-Cybersecurity-Skills

Deploy Google BeyondCorp Enterprise zero trust access controls using Identity-Aware Proxy (IAP), context-aware access policies, device trust validation, and Access Context Manager to enforce identity and posture-based access to GCP resources and internal applications.

implementing-zero-trust-with-hashicorp-boundary

mukul975/Anthropic-Cybersecurity-Skills

Implement HashiCorp Boundary for identity-aware zero trust infrastructure access management with dynamic credential brokering, session recording, and Vault integration.

import-agent

openakita/openakita

Import an Agent from a .akita-agent package file. Installs the Agent profile and any bundled skills to the local system.

import-art

bitwize-music-studio/claude-ai-music-skills

Places album art files in the correct audio and content directory locations. Use when the user has generated or downloaded album artwork that needs to be saved.

import-audio

bitwize-music-studio/claude-ai-music-skills

Moves audio files to the correct album location with proper path structure. Use when the user has downloaded WAV files from Suno or other sources that need to be organized.

import-compose

kurtosis-tech/kurtosis

Import Docker Compose files into Kurtosis. Convert docker-compose.yml to Starlark packages or run them directly. Use when migrating existing Docker Compose workflows to Kurtosis.

import-export

serac-labs/serac

Move data in and out of ServiceNow — CSV parsing into import sets, GlideImportSetTransformer runs, CSV/JSON/XML exports, scheduled data sources, bulk update and deleteMultiple safety patterns.

import-guidelines

indranilbanerjee/digital-marketing-pro

Import brand guidelines. Use when: adding voice guides, style restrictions, or messaging frameworks.

import-infrastructure-as-code

github/awesome-copilot

'Import existing Azure resources into Terraform using Azure CLI discovery and Azure Verified Modules (AVM). Use when asked to reverse-engineer live Azure infrastructure, generate Infrastructure as Code from existing subscriptions/resource groups/resource IDs, map dependencies, derive exact import addresses from downloaded module source, prevent configuration drift, and produce AVM-based Terraform files ready for validation and planning across any Azure resource type.'

import-solution

microsoft/power-platform-skills

>-

import-sop

indranilbanerjee/digital-marketing-pro

Import agency SOPs. Use when: adding workflow definitions, approval processes, or launch checklists.

import-template

indranilbanerjee/digital-marketing-pro

Import deliverable templates. Use when: adding proposal formats, report structures, or brief templates.

import-track

bitwize-music-studio/claude-ai-music-skills

Moves track markdown files to the correct album location. Use when the user has track files in Downloads or other locations that need to be placed in an album.

importance-scoring

yogsoth-ai/de-anthropocentric-research-engine

SOP: 评估研究 gap 的学术与实践重要性，输出 1-5 分及依据

impress

diegosouzapw/awesome-omni-skills

LibreOffice Impress workflow skill. Use this skill when the user needs Presentation creation, format conversion (ODP/PPTX/PDF), slide automation with LibreOffice Impress and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

impress-v2

diegosouzapw/awesome-omni-skills

LibreOffice Impress workflow skill. Use this skill when the user needs Presentation creation, format conversion (ODP/PPTX/PDF), slide automation with LibreOffice Impress and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

impressum-pflicht

Klotzkette/claude-fuer-deutsches-recht

Prüft die Impressumspflicht für Websites, Apps und Social-Media-Profile nach §§ 5 und 6 DDG und § 18 MStV, erstellt konforme Impressumstexte und identifiziert typische Abmahnrisiken nach UWG. Lädt bei Fragen zu Anbieterkennzeichnung, Impressum-Vollständigkeit und Bußgeldrisiken.

improve

SethGammon/Citadel

>-

improve

shadcn/improve

Survey any codebase as a senior advisor and produce prioritized, self-contained implementation plans for OTHER models/agents to execute. Strictly read-only on source code — never implements, fixes, or refactors anything itself. Use when asked to audit a codebase, find improvement opportunities (bugs, security, performance, test coverage, tech debt, migrations, DX), suggest features or where to take the project next (roadmap, product direction), or generate handoff plans for another agent to implement.

improve-app

wondelai/skills

Guided journey from a shipped app that works but feels rough to a product that fits the job, flows without friction, reads clearly, and persuades honestly. Orchestrates nine skills phase by phase - jobs-to-be-done, ux-heuristics, design-everyday-things, refactoring-ui, microinteractions, made-to-stick, influence-psychology, high-perf-browser, steve-jobs-design-review - asking the user questions at every decision point and recording results in the project docs/ folder (CUSTOMER.md, DESIGN.md, POSITIONING.md, IMPROVE-APP-PLAN.md) so the journey resumes across sessions. Use when the user wants to fix a clunky product, cut UX friction, sharpen in-app copy and prompts, or says ''the app works but feels rough''. Do not use for code, tests, or production hardening - use improve-code-quality (fresh prototype) or remove-technical-debt (aged codebase); no app yet, create-app; needs growth loops, grow-app; marketing-site friction, improve-website. For one framework in isolation, invoke that skill directly.

improve-architecture

rohitg00/pro-workflow

Audit an area of the codebase and propose the smallest structural moves that improve it - untangle boundaries, kill duplication, fix seams, break cycles. Produces a prioritized plan and decision records, not a rewrite. Use when a codebase feels tangled, hard to change, or is becoming a ball of mud, or when asked to improve or refactor architecture.

improve-business

wondelai/skills

Guided journey from a stalled, plateaued business to one with an honest diagnosis, a working operating rhythm, and offers repriced to real value. Orchestrates eight skills phase by phase - good-strategy-bad-strategy, traction-eos, high-output-management, team-topologies, drive-motivation, lean-analytics, negotiation, monetizing-innovation - asking the user questions at every decision point and recording results in the project docs/ folder (STRATEGY.md, OPERATIONS.md, METRICS.md, IMPROVE-BUSINESS-PLAN.md) so the journey resumes across sessions. Use when the user wants to fix a business that has plateaued, diagnose why growth stalled, tighten strategy and execution, re-motivate a team, or says ''revenue is flat and I do not know why''. Starting from scratch with no customers: use create-business. Once the fundamentals work and the goal is expansion: use grow-business. When the product itself drags the business down: use improve-app. For one framework in isolation, invoke that skill directly.

improve-code-quality

wondelai/skills

Guided journey from a working-but-untested vibe-coded prototype to a production-ready product with tests, clean structure, a business-rules boundary, and resilience at scale. Orchestrates nine skills phase by phase - working-with-legacy-code, clean-code, refactoring-patterns, software-design-philosophy, clean-architecture, pragmatic-programmer, release-it, system-design, ddia-systems - asking the user questions at every decision point and recording results in the project docs/ folder (TESTING.md, TECH-DEBT.md, RELIABILITY.md, IMPROVE-CODE-QUALITY-PLAN.md) so the journey resumes across sessions. Use when the user wants to harden an AI-generated prototype, add tests before refactoring, make code safe to change, or says ''this works on my machine but I am scared to touch it''. For a large aged codebase, use remove-technical-debt; to decide structure before building, use design-code-architecture; for a product and UX pass, use improve-app. For one framework in isolation, invoke that skill directly.

improve-codebase-architecture

EpicenterHQ/epicenter

Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.

improve-content

inhouseseo/superseo-skills

Use when rewriting or refreshing an existing page that's underperforming. The agent fetches the URL, analyzes the current content, researches the SERP, and rewrites using the full anti-AI-slop ruleset — no data exports needed.

improve-doc

existential-birds/beagle

Analyze and improve existing documentation using Diataxis principles

improve-openai-go

openai/openai-go

Audit openai-go during scheduled or repeated maintainer runs for correctness bugs, security weaknesses, performance problems, rough edges, non-idiomatic Go, test gaps, code organization, and architecture, then report one prioritized recommendation with evidence. Use for recurring proactive repository maintenance and rotating whole-codebase review; do not use for feature work, code changes, autonomous publishing, or pull-request stewardship.

improve-openai-ruby

openai/openai-ruby

Investigate customer-impacting OpenAI Ruby SDK defects and privately handled security risks, then dispatch at most five evidenced, independent fixes to isolated project worktrees.

improve-react

compozy/agh

Survey a whole React codebase as a senior React engineer, using React Doctor's scan as evidence, then produce a prioritized audit and self-contained implementation plans for other agents (or cheaper models) to execute. Read-only on source code — it plans improvements, it does not apply them. Use when the user asks to "improve the React code", "audit this codebase", "make this app faster / more robust", or wants a roadmap of fixes rather than a review of a single diff. For a regression check or a fix-it-now pass, use the `react-doctor` skill instead.

improve-readability

MicrosoftDocs/cloud-adoption-framework

Aggressively rewrites dense technical prose to maximize Flesch Reading Ease scores. Simplifies vocabulary, shortens sentences, splits paragraphs, and removes filler — without losing technical accuracy.

improve-retention

wondelai/skills

Diagnose and fix retention problems using behavior design (B=MAP). Use when the user mentions "users sign up but dont stick around", "activation rate", "onboarding friction", "retention metrics", "why users dont complete", "churn analysis", or "aha moment". Also trigger when analyzing cohort retention curves, designing activation milestones, reducing time-to-value for new users, or investigating why users quit after their first session. Covers the Ability Chain, prompt design, and tiny behaviors that compound. For habit loops and variable rewards, see hooked-ux. For intrinsic motivation, see drive-motivation.

improve-skill

openai/plugins

Turn plugin-eval findings into a concrete rewrite brief for a Codex skill. Use when the user already evaluated a skill and now wants Codex to improve it, especially after asking what to fix first.

improve-website

wondelai/skills

Guided journey from a live website that underperforms to a prioritized, evidence-backed backlog of conversion, usability, message, and speed fixes - each shipped as a testable experiment. Orchestrates eight skills phase by phase - cro-methodology, ux-heuristics, refactoring-ui, web-typography, storybrand-messaging, high-perf-browser, made-to-stick, design-everyday-things - asking the user questions at every decision point and recording results in the project docs/ folder (WEBSITE.md, DESIGN.md, EXPERIMENTS.md, IMPROVE-WEBSITE-PLAN.md) so the journey resumes across sessions. Use when the user wants to fix a landing page that isn''t converting, diagnose why visitors leave, audit for clarity and usability, or says ''the homepage feels off but a redesign didn''t help''. Do not use with no site yet - use create-website; if it converts but needs more traffic or leads, grow-website; if the friction is in a product app, not the marketing site, improve-app. For one framework in isolation, invoke that skill directly.

improving-prompts

Kastalien-Research/thoughtbox

Use when optimizing CLAUDE.md, AGENTS.md, custom commands, or skill files for Claude 4.5 models - applies documented Anthropic best practices systematically instead of inventing improvements

imsg

openclaw/openclaw

iMessage/SMS CLI for listing chats, history, and sending messages via Messages.app.

imsg-rpc

joelhooks/joelclaw

Set up, maintain, and debug the imsg-rpc Unix socket daemon that gives the gateway iMessage access via JSON-RPC. Covers FDA setup, code signing, launchd service, and the imsg source repo.

inbound-lead-audit-cx-map

zapier/gtm-cheat-codes

Audit inbound lead handling and map the customer experience from source event to follow-up outcome.

inbound-lead-enrichment

gooseworks-ai/goose-skills

>

inbound-lead-qualification

gooseworks-ai/goose-skills

>

inbound-lead-qualifier

OneWave-AI/claude-skills

Analyze inbound leads (form fills, demo requests) and score based on ICP fit, intent, and urgency. Auto-generates qualification questions, routes to right rep, and suggests personalized first touch. Use for qualifying and routing inbound leads at scale.

inbound-lead-triage

gooseworks-ai/goose-skills

>

inbox

Soul-Brews-Studio/arra-oracle-skills-cli

Read and write to Oracle inbox — notes, tasks, messages, handoffs. Use when user says "inbox", "leave a note", "write to inbox", "check inbox", "what's pending", or wants to read/write messages for self or other agents. Do NOT trigger for session handoffs (use /forward), schedule (use /schedule), or agent messaging (use /talk-to).

inbox-calendar-triage

mkurman/zorai

Canonical inbox and calendar triage pack for agenda prep, urgent unread mail, follow-ups, and draft-only response suggestions.

inbox-cleanup

vellum-ai/vellum-assistant

Run a high-recall, multi-pass email inbox cleanup. Pattern-based subject queries catch 25x more archivable email than sender scans alone. Includes urgency triage, classification signals, and post-cleanup filter setup.

inbox-management

vellum-ai/vellum-assistant

Ongoing Gmail inbox management via scheduled runs. Archives known noise, flags urgent items, drafts replies in-thread (never auto-sends), and catches stale follow-ups. Starts in flag-only mode — earns autonomy through a three-stage trust ladder.

inbox-manager

anthropics/knowledge-work-plugins

>

inbox-placement-monitor

aaron-he-zhu/aaron-marketing-skills

Use when the user asks to "track where my emails are actually landing after I send", "read my seed-list inbox vs spam vs promotions results", "trend my Gmail Postmaster / Microsoft SNDS reputation", or "did placement drop after my last send"; produces a per-provider inbox/spam/promotions placement read, a domain/IP reputation trend from Postmaster + SNDS, a send-over-send delta with named regressions, and a reusable SEND-S placement snapshot on your own exported telemetry. Not for the pre-send SPF/DKIM/DMARC auth pre-flight — use deliverability-qa; not for computing the EQS or running the vetoes — use email-quality-auditor. 邮件收件箱落点监测/收件箱vs垃圾邮件/Postmaster声誉趋势

inbox-reply

extruct-ai/gtm-skills

>

inbox-setup

alirezarezvani/claude-skills

One-time setup skill that builds a personalized inbox triage knowledge base via interactive interview. Interviews the user about their email patterns, business context, reply style, and priorities using grill-me discipline (one question at a time, forcing format where possible, dependency-ordered, each question explains why I'm asking), then generates the knowledge base files that power the companion 'inbox-triage' skill. Run this once before using inbox-triage for the first time. Re-run when business, pricing, or priorities change significantly. Triggers: 'set up my inbox', 'configure inbox triage', 'set up my email system', 'configure email triage', 'build my email knowledge base', 'initialize email management', 'set up inbox triage', 'onboard email triage', or any variation where someone wants to get the email triage system running for the first time.

inbox-sweep

anthropics/knowledge-work-plugins

Batch-process unread customer emails - classify, prioritize, and draft replies. Use when the user asks "sweep my inbox", "what customer emails need a reply", "draft replies to my customer emails", or "what needs a response".

inbox-triage

alirezarezvani/claude-skills

Runs a full inbox triage using the knowledge base created by the 'inbox-setup' skill. Light-intake by design (most invocations skip questions and run with KB-default preferences); asks at most 2 grill-me override questions when invocation is outside normal cadence or includes category-skip intent. Searches recent emails, classifies them via the user's taxonomy, researches new senders, generates recommendations, drafts replies (NEVER sends), delivers a report in the user's preferred format, and updates the knowledge base with learnings. Designed to run on a recurring schedule (1-3x daily) or on demand. Use when the user wants their inbox processed, in any variation (e.g., 'triage my inbox', 'inbox triage', 'check my email', 'run email triage', 'process my inbox', 'what's new in my email', 'handle my email', 'email triage'). Requires the inbox-setup skill to have been run first.

Incident Response & Digital Forensics

Masriyan/Claude-Code-CyberSecurity-Skill

IR playbook execution, evidence collection, forensic timeline analysis, memory forensics, and post-incident reporting following NIST SP 800-61 and SANS PICERL methodology

incident-commander

alirezarezvani/claude-skills

Comprehensive incident response framework from detection through resolution and post-incident review. Battle-tested SRE/DevOps practices: severity classification, timeline reconstruction, structured post-incident analysis. Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service.

incident-init

anthropics/claude-tag-plugins

>-

incident-investigate

anthropics/claude-tag-plugins

>-

incident-investigation

sirkirby/unifi-mcp

Investigate a network incident by correlating device events with camera footage and physical access logs. Use when the user reports a device going offline, a network anomaly, or wants to understand what caused an infrastructure event.

incident-management

serac-labs/serac

Manage ServiceNow incidents — creation with impact/urgency priority calc, auto-assignment by category, reassignment tracking, major incident declaration with bridge calls, time-based escalation, MTTR metrics.

github/incident-postmortem

github/awesome-copilot

Use when an outage, production incident, or significant service degradation has occurred and the team needs to write a structured blameless post-mortem. Triggers on phrases like "write a post-mortem", "incident review", "what went wrong", "outage report", "root cause analysis", or "RCA". Covers timeline reconstruction, contributing factor analysis, impact quantification, and action item generation with owners.

anthropics/incident-postmortem

anthropics/claude-tag-plugins

>-

mohitagw15856/incident-postmortem

mohitagw15856/pm-claude-skills

Write a structured incident postmortem or post-incident review. Use when asked to write a postmortem, incident report, P1/P2 review, outage report, or RCA (root cause analysis). Generates a blameless postmortem with timeline, root cause, contributing factors, impact summary, and action items.

incident-reporting

datadrivenconstruction/DDC_Skills_for_AI_Agents_in_Construction

Construction safety incident reporting and analysis. Capture incidents, conduct investigations, track corrective actions, and analyze trends for prevention.

incident-responder

OneWave-AI/claude-skills

Production incident response automation. Reads logs, checks recent deploys, identifies root cause, suggests fixes, drafts incident comms, creates post-mortem templates. Severity classification (SEV1-4), escalation paths, status page updates. Generates incident-report.md with timeline, root cause, impact assessment, remediation steps, and prevention measures.

incident-responder-v2

diegosouzapw/awesome-omni-skills

incident-responder workflow skill. Use this skill when the user needs Expert SRE incident responder specializing in rapid problem resolution, modern observability, and comprehensive incident management and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

incident-responder-v3

diegosouzapw/awesome-omni-skills

incident-responder workflow skill. Use this skill when the user needs Expert SRE incident responder specializing in rapid problem resolution, modern observability, and comprehensive incident management and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

incident-response

anthropics/knowledge-work-plugins

Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.

incident-response

alirezarezvani/claude-skills

Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.