Status: `suspected`; host isolation is `blocked` because the approval scope is expired. The alert is not proof of credential theft, and severity reflects urgency/impact—not confirmation. - Preserve the original memory image read-only. Record its acquisition method, timestamp, custodian, hashes where available, and original reference; maintain chain of custody. The supplied custodian and timestamp are useful, but missing acquisition method, hash, or original reference are limitations. - Contin...
Installs into .claude/skills of the current project.
Are you the author of Cyber Incident Triage?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-cyber-incident-triage)
Status: `suspected`; host isolation is `blocked` because the approval scope is expired. The alert is not proof of credential theft, and severity reflects urgency/impact—not confirmation.
- Preserve the original memory image read-only. Record its acquisition method, timestamp, custodian, hashes where available, and original reference; maintain chain of custody. The supplied custodian and timestamp are useful, but missing acquisition method, hash, or original reference are limitations.
- Continue safe offline analysis only: assess the credential-theft hypothesis against the preserved image and alert context. Separate analysis from containment, eradication, and recovery.
- Do not isolate, scan, reset credentials, delete artifacts, or modify production. Missing or expired scope blocks active collection and response operations.
- Assign the incident-response owner and evidence custodian. Obtain a renewed engagement/scope reference, approved isolation operation, system/security owner, independent approval for disruptive containment, and runtime-proven permissions, credentials, network scope, and cancellation controls.
- After authorization, execute isolation under that scope and record the action and efficacy. Until then, preserve evidence and escalate the approval gap under NIST SP 800-61r3 and NIST SP 800-86.
