Hire an AI security incident responder

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A severity classification (SEV1 to SEV4) with the reasoning behind it.
• An evidence list: what to preserve right now, before you touch anything else.
• A containment plan that stops the spread without destroying what you'll need to investigate.
• An investigation and recovery plan in order, plus a post-mortem outline once it's over.

How it does the job well

• Classify severity from what's actually described, not from how dramatic it sounds. State the reasoning.
• Keep "confirmed" and "suspected" separate everywhere in the output. Never present a guess as a fact.
• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Recommending a destructive first step (reboot, delete, wipe) before evidence is preserved.
• Naming a specific threat actor or attribution without the user supplying strong technical evidence for it.
• Copying the profile's sample scripts, severity matrix numbers or incident examples as if they were this user's facts.
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: You're looking at something suspicious right now, a strange login, a locked file, an alert, and need to know how serious it is and what to do first.

• Severity. The SEV1 to SEV4 rating and the reasoning behind it.
• Preserve before you touch anything. What disappears on reboot or cleanup, and should be captured first.
• Containment plan. The action that stops the spread without destroying evidence, and any evidence risk it carries.
• Investigation plan. The ordered steps to reconstruct the timeline from first access to now.
• Recovery plan. Whether to patch and monitor or rebuild from a known-good state, and why.
• Post-mortem outline. Root cause, contributing factors, and the few fixes that would have stopped it.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Classify severity. It rates what you're seeing from SEV1 (active data loss) to SEV4 (a policy question) and says why.
• List what to preserve. Before any containment step, it names what disappears on reboot or cleanup (memory, connections, logs) and should be kept.
• Plan containment. It proposes the stop-the-spread action that doesn't destroy evidence, such as isolating a host instead of wiping it.
• Plan the investigation. It lays out the order to reconstruct the timeline, from first access to what's affected now.
• Plan recovery. It separates "patch and hope" from rebuilding from a known-good state, and flags which one the situation needs.
• Write the post-mortem outline. Once it's over, it separates root cause from contributing factors and proposes the few fixes that would have stopped it.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id security-incident-responder only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/security-incident-responder/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• What you're observing: the alert, the symptom, or what someone reported, in your own words.
• What systems, accounts or data might be affected, as far as you know.
• Whether the activity is still happening now, or already stopped.
• Any logs, alerts or screenshots you have (optional, but they sharpen the severity call).

Helpful context (optional)

• Any SIEM or EDR alert text you have.
• Your existing incident response plan or contacts, if you have one.
• A rough timeline of what you noticed and when.

Tools and access

• Claude, ChatGPT or Gemini with file upload: It can read a log export, alert screenshot or timeline next to your description.

Functions and deliverables

• Security incident responder: Describe what you're seeing. Get a severity score, what to save before you touch anything, and a step-by-step plan to contain it and recover.
  • A severity classification (SEV1 to SEV4) with the reasoning behind it.
  • An evidence list: what to preserve right now, before you touch anything else.
  • A containment plan that stops the spread without destroying what you'll need to investigate.
  • An investigation and recovery plan in order, plus a post-mortem outline once it's over.
  Source: Michael Sitarzewski and Agency Agents contributors.
• Security incident response planner: Use security alert details to sort threats, rate harm, plan who to call, and list needed evidence.
  • An incident type and severity score
  • A false positive check
  • An escalation path
  • An evidence preservation list
  • Next steps
  Source: Alireza Rezvani.
• Incident learning report writer: Write a blameless incident post-mortem from your outage timeline and evidence. Get root causes, action items with owners and open questions.
  • A blameless post-mortem in one document, ready to share
  • A timeline with gaps in the record flagged
  • A root cause and a list of contributing factors
  • Action items with owners, due dates and priorities
  Source: GitHub Copilot community.
• AWS security checker: Check your AWS account with read-only commands. Get a ranked list of security gaps in access, network, data and logs, each with a fix.
  • A ranked list of findings with the resource and the proof
  • One fix for each finding that you can review first
  • A count of findings by severity
  • A list of checks that did not run, and why
  • A short fix order for the top five actions
  Source: sickn33.
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• You're looking at something suspicious right now, a strange login, a locked file, an alert, and need to know how serious it is and what to do first.
• You contained an incident and need a plan for the investigation and recovery that follows.
• You need to write the post-mortem: the timeline, the root cause, and the fixes that would have stopped it.
• You want a severity framework and a response runbook in place before your next incident, not during it.

Limits to check before starting

• This is a live, ongoing breach with data actively leaving right now. Call your incident response retainer and legal counsel immediately; use this agent's severity call and evidence list while you wait for them, not instead of them.
• You want a security design reviewed before anything happened. Use the Security Architect agent.
• You need day-to-day alert triage, not a structured incident. Use the Security incident response planner.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.
• Describe what you're seeing in plain words: what happened, what system or account, whether it's still happening.
• Attach any logs, alerts or screenshots you have.
• Say "Classify this and tell me what to preserve before I do anything else."
• If it's SEV1 or SEV2, call your incident response retainer or legal counsel now. Use the plan while you wait, not instead of them.
• Once contained, ask it to build the investigation plan, then the post-mortem outline, from what you actually found.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/security-incident-responder for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.