{ "schema": "aiblocks-page/1", "id": "agency-security-incident-responder", "type": "agent", "name": "Security incident responder", "summary": "Describe what you're seeing. Get a severity score, what to save before you touch anything, and a step-by-step plan to contain it and recover.", "headline": "Security incident responder", "subhead": "Describe what you're seeing, such as a strange login or a locked file. It rates how bad it is, says what to save first, then gives you steps to contain it, look into it, and recover, in order.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "source_text", "required": false, "label": "Source text", "what": "a long source in full: an article, a video or talk transcript, or notes from a book, with its title, author and link" }, { "type": "incident_record", "required": false, "label": "Incident record", "what": "the record of an outage or incident: the timeline, what was affected, the alerts and who did what" } ], "outputs": [ { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "What you're observing: the alert, the symptom, or what someone reported, in your own words.", "What systems, accounts or data might be affected, as far as you know.", "Whether the activity is still happening now, or already stopped.", "Any logs, alerts or screenshots you have (optional, but they sharpen the severity call)." ], "you_get": [ "A severity classification (SEV1 to SEV4) with the reasoning behind it.", "An evidence list: what to preserve right now, before you touch anything else.", "A containment plan that stops the spread without destroying what you'll need to investigate.", "An investigation and recovery plan in order, plus a post-mortem outline once it's over." ], "use_when": [ "You're looking at something suspicious right now, a strange login, a locked file, an alert, and need to know how serious it is and what to do first.", "You contained an incident and need a plan for the investigation and recovery that follows.", "You need to write the post-mortem: the timeline, the root cause, and the fixes that would have stopped it.", "You want a severity framework and a response runbook in place before your next incident, not during it." ], "skip_when": [ "This is a live, ongoing breach with data actively leaving right now. Call your incident response retainer and legal counsel immediately; use this agent's severity call and evidence list while you wait for them, not instead of them.", "You want a security design reviewed before anything happened. Use the Security Architect agent.", "You need day-to-day alert triage, not a structured incident. Use the Security incident response planner." ], "output_sample": { "input": [ "What you're observing, in your own words", "What systems, accounts or data might be affected", "Whether the activity is still happening now", "Logs, alerts or screenshots (optional)" ], "prerequisites": [ "An AI that can read files, if you attach logs or screenshots" ], "output": [ { "name": "Severity", "contains": "The SEV1 to SEV4 rating and the reasoning behind it." }, { "name": "Preserve before you touch anything", "contains": "What disappears on reboot or cleanup, and should be captured first." }, { "name": "Containment plan", "contains": "The action that stops the spread without destroying evidence, and any evidence risk it carries." }, { "name": "Investigation plan", "contains": "The ordered steps to reconstruct the timeline from first access to now." }, { "name": "Recovery plan", "contains": "Whether to patch and monitor or rebuild from a known-good state, and why." }, { "name": "Post-mortem outline", "contains": "Root cause, contributing factors, and the few fixes that would have stopped it." } ] }, "output_shape": "SEVERITY\n Level: | Reason: \n\nPRESERVE BEFORE YOU TOUCH ANYTHING\n | \n\nCONTAINMENT PLAN\n | | \n\nINVESTIGATION PLAN (in order)\n | \n\nRECOVERY PLAN\n | | \n\nPOST-MORTEM OUTLINE\n Root cause: <...> | Contributing factors: <...> | Top 3-5 fixes: <...>\n\nASSUMPTIONS AND CHECKS STILL NEEDED\n | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.", "Describe what you're seeing in plain words: what happened, what system or account, whether it's still happening.", "Attach any logs, alerts or screenshots you have.", "Say \"Classify this and tell me what to preserve before I do anything else.\"", "If it's SEV1 or SEV2, call your incident response retainer or legal counsel now. Use the plan while you wait, not instead of them.", "Once contained, ask it to build the investigation plan, then the post-mortem outline, from what you actually found." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "Incident runbook writer", "url": "https://useaiblocks.com/skills/incident-runbook-writer", "why": "Build it" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-incident-responder.md", "licence": "MIT", "original_name": "Incident Responder", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Incident Responder", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-incident-responder.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-security-incident-responder", "markdown": "https://useaiblocks.com/agents/agency-security-incident-responder.md", "json": "https://useaiblocks.com/agents/agency-security-incident-responder.json", "instructions": "https://useaiblocks.com/skills/agency-security-incident-responder/SKILL.md", "download": "https://useaiblocks.com/skills/agency-security-incident-responder.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-security-incident-responder", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-incident-responder", "mcp": "https://useaiblocks.com/mcp" } }