[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADYK0VNTB7XFQPRFT20DH6":3,"skill-same:01M6ADYK0VNTB7XFQPRFT20DH6":119},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":70,"commitSha":71,"skillDirectory":72,"forksCount":73,"repositoryHtmlUrl":74,"repositoryHomepageUrl":75,"ownerHtmlUrl":76,"ownerBlogUrl":77,"ownerDescription":78,"updatedAt":79,"install":80,"resources":93},"01M6ADYK0VNTB7XFQPRFT20DH6","building-incident-response-dashboard",null,"Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-response-dashboard\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000013","分析与可视化","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"incident response","building incident response dashboard","dashboard","status","teams","visualization","metrics","grafana","reporting","ioc","soc","splunk","awareness","incident-response","elastic","situational-awareness","cybersecurity","2026-11-10 10:12:30",false,"---\nname: building-incident-response-dashboard\ndescription: 'Builds real-time incident response dashboards in Splunk, Elastic, or\n  Grafana to provide SOC analysts and leadership with situational awareness during\n  active incidents, tracking affected systems, containment status, IOC spread, and\n  response timeline. Use when IR teams need unified visibility during incident coordination\n  and post-incident reporting.\n\n  '\ndomain: cybersecurity\nsubdomain: soc-operations\ntags:\n- soc\n- dashboard\n- incident-response\n- splunk\n- visualization\n- situational-awareness\n- metrics\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-02\n- RS.MA-01\n- DE.AE-06\nmitre_attack:\n- T1486\n- T1071.001\n- T1021.002\n- T1041\n- T1566\n---\n# Building Incident Response Dashboard\n\n## When to Use\n\nUse this skill when:\n- IR teams need real-time dashboards during active incidents for coordination and tracking\n- SOC leadership requires operational dashboards showing incident status and analyst workload\n- Post-incident reviews need visual timelines and impact assessments\n- Executive briefings require high-level incident metrics and trend analysis\n\n**Do not use** for day-to-day SOC monitoring dashboards (use Incident Review instead) — IR dashboards are designed for active incident coordination and management reporting.\n\n## Prerequisites\n\n- SIEM platform (Splunk with Dashboard Studio, Elastic Kibana, or Grafana)\n- Notable event and incident data in SIEM (Splunk ES incident_review index)\n- Ticketing system integration (ServiceNow, Jira) for remediation tracking\n- Asset and identity lookup tables for context enrichment\n- Dashboard publishing access for SOC team and management distribution\n\n## Workflow\n\n### Step 1: Design Active Incident Dashboard Layout\n\nBuild a Splunk Dashboard Studio dashboard for active incident tracking:\n\n```xml\n\u003Cdashboard version=\"2\" theme=\"dark\">\n  \u003Clabel>Active Incident Response Dashboard\u003C\u002Flabel>\n  \u003Cdescription>Real-time tracking for IR-2024-0450\u003C\u002Fdescription>\n\n  \u003Crow>\n    \u003Cpanel>\n      \u003Ctitle>Incident Summary\u003C\u002Ftitle>\n      \u003Csingle>\n        \u003Csearch>\n          \u003Cquery>\n| makeresults\n| eval incident_id=\"IR-2024-0450\",\n       status=\"CONTAINMENT\",\n       severity=\"Critical\",\n       affected_hosts=7,\n       contained_hosts=5,\n       iocs_identified=23,\n       hours_elapsed=round((now()-strptime(\"2024-03-15 14:00\",\"%Y-%m-%d %H:%M\"))\u002F3600,1)\n| table incident_id, status, severity, affected_hosts, contained_hosts, iocs_identified, hours_elapsed\n          \u003C\u002Fquery>\n        \u003C\u002Fsearch>\n      \u003C\u002Fsingle>\n    \u003C\u002Fpanel>\n  \u003C\u002Frow>\n\u003C\u002Fdashboard>\n```\n\n### Step 2: Build Real-Time Affected Systems Panel\n\nTrack affected systems and their containment status:\n\n```spl\n| inputlookup ir_affected_systems.csv\n| eval status_color = case(\n    status=\"Contained\", \"#2ecc71\",\n    status=\"Compromised\", \"#e74c3c\",\n    status=\"Investigating\", \"#f39c12\",\n    status=\"Recovered\", \"#3498db\",\n    1=1, \"#95a5a6\"\n  )\n| stats count by status\n| eval order = case(status=\"Compromised\", 1, status=\"Investigating\", 2,\n                    status=\"Contained\", 3, status=\"Recovered\", 4)\n| sort order\n| table status, count\n\n--- Detailed host table\n| inputlookup ir_affected_systems.csv\n| lookup asset_lookup_by_cidr ip AS host_ip OUTPUT category, owner, priority\n| table hostname, host_ip, category, owner, status, containment_time,\n        compromise_vector, analyst_assigned\n| sort status, hostname\n```\n\n### Step 3: Build IOC Tracking Panel\n\nMonitor IOC spread across the environment:\n\n```spl\n--- IOCs identified during incident\nindex=* (src_ip IN (\"185.234.218.50\", \"45.77.123.45\") OR\n         dest IN (\"evil-c2.com\", \"malware-drop.com\") OR\n         file_hash IN (\"a1b2c3d4...\", \"e5f6a7b8...\"))\nearliest=\"2024-03-14\"\n| stats count AS hits, dc(src_ip) AS unique_sources,\n        dc(dest) AS unique_dests, latest(_time) AS last_seen\n  by sourcetype\n| sort - hits\n\n--- IOC timeline\nindex=* (src_ip IN (\"185.234.218.50\") OR dest=\"evil-c2.com\")\nearliest=\"2024-03-14\"\n| timechart span=1h count by sourcetype\n\n--- New IOC discovery tracking\n| inputlookup ir_ioc_list.csv\n| stats count by ioc_type, source, discovery_time\n| sort discovery_time\n| table discovery_time, ioc_type, ioc_value, source, status\n```\n\n### Step 4: Build Response Timeline Panel\n\nCreate chronological incident timeline:\n\n```spl\n| inputlookup ir_timeline.csv\n| sort _time\n| eval phase = case(\n    action_type=\"detection\", \"Detection\",\n    action_type=\"triage\", \"Triage\",\n    action_type=\"containment\", \"Containment\",\n    action_type=\"eradication\", \"Eradication\",\n    action_type=\"recovery\", \"Recovery\",\n    1=1, \"Other\"\n  )\n| eval phase_color = case(\n    phase=\"Detection\", \"#e74c3c\",\n    phase=\"Triage\", \"#f39c12\",\n    phase=\"Containment\", \"#e67e22\",\n    phase=\"Eradication\", \"#2ecc71\",\n    phase=\"Recovery\", \"#3498db\"\n  )\n| table _time, phase, action, analyst, details\n```\n\nExample timeline data:\n```csv\n_time,action_type,action,analyst,details\n2024-03-15 14:00,detection,Alert triggered - Cobalt Strike beacon detected,splunk_es,Notable event NE-2024-08921\n2024-03-15 14:12,triage,Alert triaged - confirmed true positive,analyst_jdoe,VT score 52\u002F72 on beacon hash\n2024-03-15 14:23,containment,Host WORKSTATION-042 isolated,analyst_jdoe,CrowdStrike network isolation\n2024-03-15 14:35,containment,C2 domain blocked on firewall,analyst_msmith,Palo Alto rule deployed\n2024-03-15 15:00,eradication,Enterprise-wide IOC scan initiated,analyst_jdoe,Splunk search across all indices\n2024-03-15 15:30,containment,3 additional hosts identified and isolated,analyst_msmith,Lateral movement confirmed\n2024-03-15 16:00,eradication,Malware removed from all affected hosts,analyst_tier3,CrowdStrike RTR cleanup\n2024-03-15 18:00,recovery,Systems restored and monitored,analyst_msmith,72-hour monitoring period started\n```\n\n### Step 5: Build SOC Operations Dashboard\n\nTrack overall SOC performance metrics:\n\n```spl\n--- Incident volume by severity (last 30 days)\nindex=notable earliest=-30d\n| stats count by urgency\n| eval order = case(urgency=\"critical\", 1, urgency=\"high\", 2, urgency=\"medium\", 3,\n                    urgency=\"low\", 4, urgency=\"informational\", 5)\n| sort order\n\n--- MTTD (Mean Time to Detect)\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttd_minutes = round((time_of_first_event - orig_time) \u002F 60, 1)\n| stats avg(mttd_minutes) AS avg_mttd, median(mttd_minutes) AS med_mttd,\n        perc95(mttd_minutes) AS p95_mttd\n\n--- MTTR (Mean Time to Respond\u002FResolve)\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttr_hours = round((status_end - _time) \u002F 3600, 1)\n| stats avg(mttr_hours) AS avg_mttr, median(mttr_hours) AS med_mttr by urgency\n\n--- Analyst workload distribution\nindex=notable earliest=-7d\n| stats count by owner\n| sort - count\n\n--- Alert disposition breakdown\nindex=notable earliest=-30d status_label IN (\"Resolved*\", \"Closed*\")\n| stats count by disposition\n| eval percentage = round(count \u002F sum(count) * 100, 1)\n| sort - count\n```\n\n### Step 6: Build Executive Briefing Dashboard\n\nCreate a high-level dashboard for leadership during major incidents:\n\n```spl\n--- Executive summary panel\n| makeresults\n| eval metrics = \"Business Impact: 1 file server offline (Finance dept), \"\n                .\"Estimated Recovery: 4 hours, \"\n                .\"Data Loss Risk: Low (backups verified), \"\n                .\"Customer Impact: None, \"\n                .\"Regulatory Notification: Not required (no PII exposure confirmed)\"\n\n--- Trend comparison (this month vs last month)\nindex=notable earliest=-60d\n| eval period = if(_time > relative_time(now(), \"-30d\"), \"Current Month\", \"Previous Month\")\n| stats count by period, urgency\n| chart sum(count) AS incidents by period, urgency\n\n--- Top threat categories\nindex=notable earliest=-30d\n| top rule_name limit=10\n| table rule_name, count, percent\n```\n\n### Step 7: Automate Dashboard Updates\n\nUse Splunk scheduled searches to maintain dashboard data:\n\n```spl\n--- Scheduled search to update affected systems lookup (runs every 5 minutes)\nindex=* (src_ip IN [| inputlookup ir_ioc_list.csv | search ioc_type=\"ip\"\n                    | fields ioc_value | rename ioc_value AS src_ip])\nearliest=-1h\n| stats latest(_time) AS last_seen, count AS event_count,\n        values(sourcetype) AS data_sources by src_ip\n| eval status = if(last_seen > relative_time(now(), \"-15m\"), \"Active\", \"Dormant\")\n| outputlookup ir_affected_systems_auto.csv\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Situational Awareness** | Real-time understanding of incident scope, affected systems, and response progress |\n| **MTTD** | Mean Time to Detect — average time from threat occurrence to SOC alert generation |\n| **MTTR** | Mean Time to Respond — average time from alert to incident resolution or containment |\n| **Containment Rate** | Percentage of affected systems successfully isolated relative to total compromised systems |\n| **Burn-Down Chart** | Visual tracking of remaining open investigation tasks over time during an incident |\n| **Executive Briefing** | Non-technical summary dashboard showing business impact, timeline, and recovery status |\n\n## Tools & Systems\n\n- **Splunk Dashboard Studio**: Modern dashboard framework with drag-and-drop visualization and real-time data\n- **Elastic Kibana Dashboard**: Visualization platform with Lens, Maps, and Canvas for security dashboards\n- **Grafana**: Open-source visualization platform supporting multiple data sources including Elasticsearch and Splunk\n- **Microsoft Sentinel Workbooks**: Azure-native dashboard framework with Kusto-based analytics visualization\n- **TheHive**: Open-source incident response platform with built-in case tracking and metrics dashboards\n\n## Common Scenarios\n\n- **Active Ransomware Incident**: Dashboard showing encryption spread, containment status, backup verification, recovery progress\n- **Data Breach Investigation**: Dashboard tracking affected data stores, exfiltration volume, notification requirements\n- **Phishing Campaign Response**: Dashboard showing recipient count, click rate, credential exposure, remediation status\n- **Monthly SOC Report**: Leadership dashboard with incident trends, MTTD\u002FMTTR metrics, analyst performance\n- **Compliance Audit**: Dashboard demonstrating detection coverage, response SLA compliance, and incident closure metrics\n\n## Output Format\n\n```\nINCIDENT RESPONSE DASHBOARD — IR-2024-0450\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nSTATUS: CONTAINMENT PHASE (6h 30m elapsed)\n\nAffected Systems:          Containment Progress:\n  Compromised:   2         [==========----------] 71%\n  Investigating: 1         5 of 7 systems contained\n  Contained:     3\n  Recovered:     1\n\nIOC Summary:               Response Timeline:\n  IPs:      4              14:00 — Alert triggered\n  Domains:  2              14:12 — Confirmed malicious\n  Hashes:   3              14:23 — First host isolated\n  URLs:     5              15:00 — Enterprise scan started\n  Emails:   1              15:30 — 3 more hosts isolated\n\nKey Metrics:\n  MTTD:    12 minutes\n  MTTC:    23 minutes (first host)\n  Analysts Active: 3 (Tier 2: 2, Tier 3: 1)\n\nBusiness Impact: LOW — Finance file server offline, no customer-facing systems affected\n```\n","# Building Incident Response Dashboard\n\n## When to Use\n\nUse this skill when:\n- IR teams need real-time dashboards during active incidents for coordination and tracking\n- SOC leadership requires operational dashboards showing incident status and analyst workload\n- Post-incident reviews need visual timelines and impact assessments\n- Executive briefings require high-level incident metrics and trend analysis\n\n**Do not use** for day-to-day SOC monitoring dashboards (use Incident Review instead) — IR dashboards are designed for active incident coordination and management reporting.\n\n## Prerequisites\n\n- SIEM platform (Splunk with Dashboard Studio, Elastic Kibana, or Grafana)\n- Notable event and incident data in SIEM (Splunk ES incident_review index)\n- Ticketing system integration (ServiceNow, Jira) for remediation tracking\n- Asset and identity lookup tables for context enrichment\n- Dashboard publishing access for SOC team and management distribution\n\n## Workflow\n\n### Step 1: Design Active Incident Dashboard Layout\n\nBuild a Splunk Dashboard Studio dashboard for active incident tracking:\n\n```xml\n\u003Cdashboard version=\"2\" theme=\"dark\">\n  \u003Clabel>Active Incident Response Dashboard\u003C\u002Flabel>\n  \u003Cdescription>Real-time tracking for IR-2024-0450\u003C\u002Fdescription>\n\n  \u003Crow>\n    \u003Cpanel>\n      \u003Ctitle>Incident Summary\u003C\u002Ftitle>\n      \u003Csingle>\n        \u003Csearch>\n          \u003Cquery>\n| makeresults\n| eval incident_id=\"IR-2024-0450\",\n       status=\"CONTAINMENT\",\n       severity=\"Critical\",\n       affected_hosts=7,\n       contained_hosts=5,\n       iocs_identified=23,\n       hours_elapsed=round((now()-strptime(\"2024-03-15 14:00\",\"%Y-%m-%d %H:%M\"))\u002F3600,1)\n| table incident_id, status, severity, affected_hosts, contained_hosts, iocs_identified, hours_elapsed\n          \u003C\u002Fquery>\n        \u003C\u002Fsearch>\n      \u003C\u002Fsingle>\n    \u003C\u002Fpanel>\n  \u003C\u002Frow>\n\u003C\u002Fdashboard>\n```\n\n### Step 2: Build Real-Time Affected Systems Panel\n\nTrack affected systems and their containment status:\n\n```spl\n| inputlookup ir_affected_systems.csv\n| eval status_color = case(\n    status=\"Contained\", \"#2ecc71\",\n    status=\"Compromised\", \"#e74c3c\",\n    status=\"Investigating\", \"#f39c12\",\n    status=\"Recovered\", \"#3498db\",\n    1=1, \"#95a5a6\"\n  )\n| stats count by status\n| eval order = case(status=\"Compromised\", 1, status=\"Investigating\", 2,\n                    status=\"Contained\", 3, status=\"Recovered\", 4)\n| sort order\n| table status, count\n\n--- Detailed host table\n| inputlookup ir_affected_systems.csv\n| lookup asset_lookup_by_cidr ip AS host_ip OUTPUT category, owner, priority\n| table hostname, host_ip, category, owner, status, containment_time,\n        compromise_vector, analyst_assigned\n| sort status, hostname\n```\n\n### Step 3: Build IOC Tracking Panel\n\nMonitor IOC spread across the environment:\n\n```spl\n--- IOCs identified during incident\nindex=* (src_ip IN (\"185.234.218.50\", \"45.77.123.45\") OR\n         dest IN (\"evil-c2.com\", \"malware-drop.com\") OR\n         file_hash IN (\"a1b2c3d4...\", \"e5f6a7b8...\"))\nearliest=\"2024-03-14\"\n| stats count AS hits, dc(src_ip) AS unique_sources,\n        dc(dest) AS unique_dests, latest(_time) AS last_seen\n  by sourcetype\n| sort - hits\n\n--- IOC timeline\nindex=* (src_ip IN (\"185.234.218.50\") OR dest=\"evil-c2.com\")\nearliest=\"2024-03-14\"\n| timechart span=1h count by sourcetype\n\n--- New IOC discovery tracking\n| inputlookup ir_ioc_list.csv\n| stats count by ioc_type, source, discovery_time\n| sort discovery_time\n| table discovery_time, ioc_type, ioc_value, source, status\n```\n\n### Step 4: Build Response Timeline Panel\n\nCreate chronological incident timeline:\n\n```spl\n| inputlookup ir_timeline.csv\n| sort _time\n| eval phase = case(\n    action_type=\"detection\", \"Detection\",\n    action_type=\"triage\", \"Triage\",\n    action_type=\"containment\", \"Containment\",\n    action_type=\"eradication\", \"Eradication\",\n    action_type=\"recovery\", \"Recovery\",\n    1=1, \"Other\"\n  )\n| eval phase_color = case(\n    phase=\"Detection\", \"#e74c3c\",\n    phase=\"Triage\", \"#f39c12\",\n    phase=\"Containment\", \"#e67e22\",\n    phase=\"Eradication\", \"#2ecc71\",\n    phase=\"Recovery\", \"#3498db\"\n  )\n| table _time, phase, action, analyst, details\n```\n\nExample timeline data:\n```csv\n_time,action_type,action,analyst,details\n2024-03-15 14:00,detection,Alert triggered - Cobalt Strike beacon detected,splunk_es,Notable event NE-2024-08921\n2024-03-15 14:12,triage,Alert triaged - confirmed true positive,analyst_jdoe,VT score 52\u002F72 on beacon hash\n2024-03-15 14:23,containment,Host WORKSTATION-042 isolated,analyst_jdoe,CrowdStrike network isolation\n2024-03-15 14:35,containment,C2 domain blocked on firewall,analyst_msmith,Palo Alto rule deployed\n2024-03-15 15:00,eradication,Enterprise-wide IOC scan initiated,analyst_jdoe,Splunk search across all indices\n2024-03-15 15:30,containment,3 additional hosts identified and isolated,analyst_msmith,Lateral movement confirmed\n2024-03-15 16:00,eradication,Malware removed from all affected hosts,analyst_tier3,CrowdStrike RTR cleanup\n2024-03-15 18:00,recovery,Systems restored and monitored,analyst_msmith,72-hour monitoring period started\n```\n\n### Step 5: Build SOC Operations Dashboard\n\nTrack overall SOC performance metrics:\n\n```spl\n--- Incident volume by severity (last 30 days)\nindex=notable earliest=-30d\n| stats count by urgency\n| eval order = case(urgency=\"critical\", 1, urgency=\"high\", 2, urgency=\"medium\", 3,\n                    urgency=\"low\", 4, urgency=\"informational\", 5)\n| sort order\n\n--- MTTD (Mean Time to Detect)\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttd_minutes = round((time_of_first_event - orig_time) \u002F 60, 1)\n| stats avg(mttd_minutes) AS avg_mttd, median(mttd_minutes) AS med_mttd,\n        perc95(mttd_minutes) AS p95_mttd\n\n--- MTTR (Mean Time to Respond\u002FResolve)\nindex=notable earliest=-30d status_label=\"Resolved*\"\n| eval mttr_hours = round((status_end - _time) \u002F 3600, 1)\n| stats avg(mttr_hours) AS avg_mttr, median(mttr_hours) AS med_mttr by urgency\n\n--- Analyst workload distribution\nindex=notable earliest=-7d\n| stats count by owner\n| sort - count\n\n--- Alert disposition breakdown\nindex=notable earliest=-30d status_label IN (\"Resolved*\", \"Closed*\")\n| stats count by disposition\n| eval percentage = round(count \u002F sum(count) * 100, 1)\n| sort - count\n```\n\n### Step 6: Build Executive Briefing Dashboard\n\nCreate a high-level dashboard for leadership during major incidents:\n\n```spl\n--- Executive summary panel\n| makeresults\n| eval metrics = \"Business Impact: 1 file server offline (Finance dept), \"\n                .\"Estimated Recovery: 4 hours, \"\n                .\"Data Loss Risk: Low (backups verified), \"\n                .\"Customer Impact: None, \"\n                .\"Regulatory Notification: Not required (no PII exposure confirmed)\"\n\n--- Trend comparison (this month vs last month)\nindex=notable earliest=-60d\n| eval period = if(_time > relative_time(now(), \"-30d\"), \"Current Month\", \"Previous Month\")\n| stats count by period, urgency\n| chart sum(count) AS incidents by period, urgency\n\n--- Top threat categories\nindex=notable earliest=-30d\n| top rule_name limit=10\n| table rule_name, count, percent\n```\n\n### Step 7: Automate Dashboard Updates\n\nUse Splunk scheduled searches to maintain dashboard data:\n\n```spl\n--- Scheduled search to update affected systems lookup (runs every 5 minutes)\nindex=* (src_ip IN [| inputlookup ir_ioc_list.csv | search ioc_type=\"ip\"\n                    | fields ioc_value | rename ioc_value AS src_ip])\nearliest=-1h\n| stats latest(_time) AS last_seen, count AS event_count,\n        values(sourcetype) AS data_sources by src_ip\n| eval status = if(last_seen > relative_time(now(), \"-15m\"), \"Active\", \"Dormant\")\n| outputlookup ir_affected_systems_auto.csv\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Situational Awareness** | Real-time understanding of incident scope, affected systems, and response progress |\n| **MTTD** | Mean Time to Detect — average time from threat occurrence to SOC alert generation |\n| **MTTR** | Mean Time to Respond — average time from alert to incident resolution or containment |\n| **Containment Rate** | Percentage of affected systems successfully isolated relative to total compromised systems |\n| **Burn-Down Chart** | Visual tracking of remaining open investigation tasks over time during an incident |\n| **Executive Briefing** | Non-technical summary dashboard showing business impact, timeline, and recovery status |\n\n## Tools & Systems\n\n- **Splunk Dashboard Studio**: Modern dashboard framework with drag-and-drop visualization and real-time data\n- **Elastic Kibana Dashboard**: Visualization platform with Lens, Maps, and Canvas for security dashboards\n- **Grafana**: Open-source visualization platform supporting multiple data sources including Elasticsearch and Splunk\n- **Microsoft Sentinel Workbooks**: Azure-native dashboard framework with Kusto-based analytics visualization\n- **TheHive**: Open-source incident response platform with built-in case tracking and metrics dashboards\n\n## Common Scenarios\n\n- **Active Ransomware Incident**: Dashboard showing encryption spread, containment status, backup verification, recovery progress\n- **Data Breach Investigation**: Dashboard tracking affected data stores, exfiltration volume, notification requirements\n- **Phishing Campaign Response**: Dashboard showing recipient count, click rate, credential exposure, remediation status\n- **Monthly SOC Report**: Leadership dashboard with incident trends, MTTD\u002FMTTR metrics, analyst performance\n- **Compliance Audit**: Dashboard demonstrating detection coverage, response SLA compliance, and incident closure metrics\n\n## Output Format\n\n```\nINCIDENT RESPONSE DASHBOARD — IR-2024-0450\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\nSTATUS: CONTAINMENT PHASE (6h 30m elapsed)\n\nAffected Systems:          Containment Progress:\n  Compromised:   2         [==========----------] 71%\n  Investigating: 1         5 of 7 systems contained\n  Contained:     3\n  Recovered:     1\n\nIOC Summary:               Response Timeline:\n  IPs:      4              14:00 — Alert triggered\n  Domains:  2              14:12 — Confirmed malicious\n  Hashes:   3              14:23 — First host isolated\n  URLs:     5              15:00 — Enterprise scan started\n  Emails:   1              15:30 — 3 more hosts isolated\n\nKey Metrics:\n  MTTD:    12 minutes\n  MTTC:    23 minutes (first host)\n  Analysts Active: 3 (Tier 2: 2, Tier 3: 1)\n\nBusiness Impact: LOW — Finance file server offline, no customer-facing systems affected\n```\n",{"name":5,"tags":54,"author":55,"domain":48,"license":15,"version":56,"nist_csf":57,"subdomain":62,"description":63,"mitre_attack":64},[42,34,45,43,37,47,38],"mahipal","1.0",[58,59,60,61],"DE.CM-01","DE.AE-02","RS.MA-01","DE.AE-06","soc-operations","Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.\n",[65,66,67,68,69],"T1486","T1071.001","T1021.002","T1041","T1566","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fbuilding-incident-response-dashboard",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":81,"prompt":91,"zipAvailable":92},[82,85,88],{"tool":83,"command":84},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-incident-response-dashboard",{"tool":86,"command":87},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-incident-response-dashboard",{"tool":89,"command":90},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill building-incident-response-dashboard","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-response-dashboard\u002FSKILL.md",true,[94,99,103,109,115],{"path":95,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-response-dashboard\u002FLICENSE",{"path":100,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE.txt",11357,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fenterprise-communication\u002Finternal-comms-community\u002FLICENSE.txt",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",2208,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-response-dashboard\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":111,"resourceTypeDesc":112,"sizeBytes":113,"sourceHtmlUrl":114},"scripts\u002Fagent.py","SCRIPT","脚本",7343,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-response-dashboard\u002Fscripts\u002Fagent.py",{"path":116,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":117,"sourceHtmlUrl":118},"SKILL.es.md",12533,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fbuilding-incident-response-dashboard\u002FSKILL.es.md",[120,146,170,197,223,249],{"skillNo":121,"name":122,"nameZh":6,"description":123,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":124,"categories":125,"keywords":127,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[126],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[128,129,130,131,132,48,32,133,134,135,136,137,138,139,140,141,142,143,144,145],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[152],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[154,142,155,156,132,157,48,134,158,159,160,161,162,163,164,165,166,167,168,169],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":180,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[176,179],{"categoryNo":177,"categoryName":178,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[164,181,182,183,184,48,185,186,158,187,188,45,189,190,191,192,193,194,195,196],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":201,"categories":202,"keywords":204,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[203],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[205,206,207,48,208,209,210,211,212,213,214,215,216,217,218,219,161,220,221,222],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":230,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[229],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[231,232,233,48,35,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":250,"name":251,"nameZh":6,"description":252,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":253,"categories":254,"keywords":256,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[255],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[132,257,48,258,259,41,42,260,261,262,263,192,264,193,265,266,267,268,269,270],"triaging security incident","siem","file","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]