Incident Forensics
Investigate breaches methodically.
Install 安装
curl -sSL https://updating.cc/skills/security/incident-forensics/SKILL.md -o ~/.agents/skills/security__incident-forensics/SKILL.mdSKILL.md Preview 技能内容预览
---
name: Incident Forensics
description: Investigate breaches methodically.
---
# Incident Forensics
Forensics reconstructs what happened in a breach: how they got in, what they touched, what they took. Rushing to "fix" before preserving evidence destroys the timeline you need.
## Method
1. **Contain, don't destroy.** Isolate affected systems but don't wipe them — memory and disk hold the evidence. Snapshot before cleaning.
2. **Preserve evidence.** Capture logs, images, memory dumps with chain of custody. These may be needed for legal or insurance.
3. **Build the timeline.** First access, lateral movement, actions, exfiltration. Logs from every layer (network, host, app) triangulate.
4. **Scope.** What data was accessible? Assume the worst case; confirm down.
5. **Root cause + remediation.** Close the hole that let them in, and any other path to the same outcome.
## Comms
Legal and disclosure obligations have deadlines. Loop them in early; don't let forensics discovery pace slip a mandatory breach notification.