conducting-cloud-incident-response

by mukul975

conducting-cloud-incident-response is a cloud incident response skill for AWS, Azure, and GCP. It focuses on identity-based containment, log review, resource isolation, and forensic evidence capture. Use it for suspicious API activity, compromised access keys, or cloud-hosted workload breaches when you need a practical conducting-cloud-incident-response guide.

Stars0

Favorites0

Comments0

AddedMay 9, 2026

CategoryIncident Response

Install Command

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-cloud-incident-response

Curation Score

This skill scores 78/100 and is a solid listing candidate: it gives directory users a credible cloud incident-response workflow with concrete AWS containment and evidence-collection actions, so installation is likely worthwhile for teams handling cloud compromise. The main caveat is that the evidence is strongest for AWS, while the description advertises AWS, Azure, and GCP more broadly.

78/100

Strengths

Explicit trigger conditions for cloud incidents, including CloudTrail/Azure/GCP audit log findings and compromised identities
Operationally useful script and API reference for containment steps like disabling access keys, isolating EC2, and capturing snapshots
Clear 'do not use' guidance and prerequisites reduce guesswork for when the skill fits

Cautions

Despite multi-cloud wording, the referenced workflow and script evidence are AWS-centered, so Azure/GCP support appears less substantiated
No install command in SKILL.md, which makes setup/discovery less immediate for directory users

Aws Azure Gcp Cloud Cloud Security Forensics Containment

Overview

Overview of conducting-cloud-incident-response skill

The conducting-cloud-incident-response skill helps you respond to real cloud security incidents across AWS, Azure, and GCP by focusing on containment, log review, resource isolation, and evidence capture. It is best for incident responders, security engineers, and platform teams who need a practical conducting-cloud-incident-response guide for identity compromise, suspicious API activity, or a cloud-hosted workload breach.

What this skill is for

Use the conducting-cloud-incident-response skill when the first problem is not “how do I investigate?” but “how do I stop the blast radius safely?” It is built around cloud-native response steps, especially identity-based containment and forensic preservation for ephemeral infrastructure.

When it fits best

This skill is a strong fit if you already have cloud logs enabled and need structured help with AWS CloudTrail, Azure Activity/Sign-in Logs, or GCP Audit Logs. It is especially relevant for compromised access keys, suspicious IAM changes, unauthorized compute or storage actions, and incidents that cross multiple cloud services.

Main differentiators

Unlike a generic incident-response prompt, conducting-cloud-incident-response centers on cloud-specific actions such as isolating resources, disabling identities, and preserving evidence before it disappears. The repository also includes a script and API reference, which makes the conducting-cloud-incident-response for Incident Response use case more operational than purely advisory.

How to Use conducting-cloud-incident-response skill

Install the skill

To perform the conducting-cloud-incident-response install, add the skill from the repo path:

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-cloud-incident-response

After install, verify that your environment can access the supporting files in skills/conducting-cloud-incident-response/.

What to read first

Start with SKILL.md to understand the incident-response flow, then inspect references/api-reference.md for the AWS-oriented command behavior and scripts/agent.py for implementation details. If you are deciding whether the skill matches your environment, these files tell you more than the folder name alone.

How to prompt it well

For good conducting-cloud-incident-response usage, give the skill a short but complete incident packet: cloud provider, suspected identity, affected resources, detection source, and what you already changed. A weak prompt says “help with a breach”; a stronger one says “investigate a suspected AWS access-key compromise, isolate EC2 instance i-0abc123, and preserve evidence without deleting logs.”

Practical workflow and limits

Use the skill to structure response, not to replace your cloud admin context. It works best when you can provide account IDs, instance IDs, usernames, or ticket references, and when you can confirm whether read-only, containment, or forensic actions are allowed. If the incident is on-prem only, the skill is the wrong fit.

conducting-cloud-incident-response skill FAQ

Is this only for AWS?

No. The description covers AWS, Azure, and GCP, but the support files in this repo show the clearest implementation detail for AWS response actions. If your goal is conducting-cloud-incident-response for Incident Response across multiple clouds, it still helps as a workflow guide, but you should expect to adapt specifics for Azure or GCP.

Do I need prior incident-response experience?

Not necessarily, but you do need enough context to name the cloud, the suspected identity, and the affected resource. Beginners can use the conducting-cloud-incident-response skill if they can supply those details and follow containment-first guidance.

How is this different from a normal prompt?

A normal prompt often asks for “investigation steps.” This skill is more useful when you need an ordered response path with cloud-specific actions, evidence preservation, and containment decisions that match the provider and resource type.

When should I not use it?

Do not use it for incidents with no cloud component, or when you need deep malware analysis unrelated to cloud identity, logging, or infrastructure control. In those cases, a standard enterprise IR workflow or endpoint-focused playbook is a better match.

How to Improve conducting-cloud-incident-response skill

Provide the exact cloud facts

The biggest quality gain comes from supplying the smallest set of facts that changes the response path: provider, account or subscription, impacted identity, affected resource IDs, alert source, and the time window. That gives the conducting-cloud-incident-response skill enough context to prioritize containment and logs instead of guessing.

State what actions are allowed

If you want usable output, say whether the skill may disable keys, isolate instances, attach deny policies, or only propose actions for approval. Without that boundary, you may get a correct plan that is unusable in your environment because it assumes permissions you do not have.

Ask for the artifact you need

The skill can be used for a response checklist, a containment sequence, a forensic triage plan, or an analyst handoff note. Ask for one deliverable at a time, such as “produce a cloud IR containment checklist for a suspected compromised IAM user,” rather than a broad “analyze everything” request.

Iterate with evidence, not more noise

If the first result is too generic, add the specific log clues, resource names, or failed commands that matter. The best conducting-cloud-incident-response usage comes from tightening the incident timeline and the scope of compromise, then asking for the next decision step instead of restarting the whole investigation.

Ratings & Reviews

No ratings yet

Share your review

0/10000

Latest reviews

Saving...

more skill

conducting-malware-incident-response

by mukul975

conducting-malware-incident-response helps IR teams triage suspected malware, confirm infections, scope spread, contain endpoints, and support eradication and recovery. It is designed for conducting-malware-incident-response for Incident Response workflows with evidence-backed steps, telemetry-driven decisions, and practical containment guidance.

Incident Response

Favorites 0GitHub 0

detecting-s3-data-exfiltration-attempts

by mukul975

detecting-s3-data-exfiltration-attempts helps investigate possible AWS S3 data theft by correlating CloudTrail S3 data events, GuardDuty findings, Amazon Macie alerts, and S3 access patterns. Use this detecting-s3-data-exfiltration-attempts skill for Security Audit, incident response, and suspicious bulk-download analysis.

Security Audit

Favorites 0GitHub 6.2k

analyzing-usb-device-connection-history

by mukul975

analyzing-usb-device-connection-history helps investigate USB device connection history on Windows using registry hives, event logs, and setupapi.dev.log for Digital Forensics, insider threat work, and incident response. It supports timeline reconstruction, device correlation, and removable-media evidence analysis.

Digital Forensics

Favorites 0GitHub 6.2k

analyzing-bootkit-and-rootkit-samples

by mukul975

analyzing-bootkit-and-rootkit-samples is a malware analysis skill for MBR, VBR, UEFI, and rootkit investigations. Use it to inspect boot sectors, firmware modules, and anti-rootkit indicators when compromise persists below the OS layer. It is suited for analysts who need a practical guide, clear workflow, and evidence-based triage for Malware Analysis.

Malware Analysis

Favorites 0GitHub 6.2k

extracting-browser-history-artifacts

by mukul975

extracting-browser-history-artifacts is a Digital Forensics skill for extracting browser history, cookies, cache, downloads, and bookmarks from Chrome, Firefox, and Edge. Use it to turn browser profile files into timeline-ready evidence with repeatable, case-focused workflow guidance.

Digital Forensics

Favorites 0GitHub 0

detecting-ransomware-encryption-behavior

by mukul975

detecting-ransomware-encryption-behavior helps defenders spot ransomware-style encryption using entropy analysis, file I/O monitoring, and behavioral heuristics. It is suited for incident response, SOC tuning, and red-team validation when you need to detect mass file changes, rename bursts, and suspicious process activity quickly.

Incident Response

Favorites 0GitHub 0

detecting-privilege-escalation-attempts

by mukul975

detecting-privilege-escalation-attempts helps hunt privilege escalation on Windows and Linux, including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse. Built for threat hunting teams that need a practical workflow, reference queries, and helper scripts.

Threat Hunting

Favorites 0GitHub 0

detecting-evasion-techniques-in-endpoint-logs

by mukul975

The detecting-evasion-techniques-in-endpoint-logs skill helps hunt defense evasion in Windows endpoint logs, including log clearing, timestomping, process injection, and security tool disabling. Use it for threat hunting, detection engineering, and incident triage with Sysmon, Windows Security, or EDR telemetry.

Threat Hunting

Favorites 0GitHub 0

analyzing-network-traffic-for-incidents

by mukul975

analyzing-network-traffic-for-incidents helps incident responders analyze PCAPs, flow logs, and packet captures to confirm C2, lateral movement, exfiltration, and exploitation attempts. Built for analyzing-network-traffic-for-incidents for Incident Response with Wireshark, Zeek, and NetFlow-style investigation.

Incident Response

Favorites 0GitHub 0

detecting-credential-dumping-techniques

by mukul975

The detecting-credential-dumping-techniques skill helps you detect LSASS access, SAM export, NTDS.dit theft, and comsvcs.dll MiniDump abuse using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules. It is built for threat hunting, detection engineering, and Security Audit workflows.

Security Audit

Favorites 0GitHub 0

correlating-security-events-in-qradar

by mukul975

correlating-security-events-in-qradar helps SOC and detection teams correlate IBM QRadar offenses with AQL, offense context, custom rules, and reference data. Use this guide to investigate incidents, reduce false positives, and build stronger correlation logic for Incident Response.

Incident Response

Favorites 0GitHub 0

containing-active-breach

by mukul975

containing-active-breach is an incident-response skill for live breach containment. It helps isolate hosts, block suspicious traffic, disable compromised accounts, and slow lateral movement using a structured containing-active-breach guide with practical API and script references.

Incident Response

Favorites 0GitHub 0

configuring-suricata-for-network-monitoring

by mukul975

The configuring-suricata-for-network-monitoring skill helps deploy and tune Suricata for IDS/IPS monitoring, EVE JSON logging, rules management, and SIEM-ready output. It suits the configuring-suricata-for-network-monitoring for Security Audit workflow when you need practical setup, validation, and false-positive reduction.

Security Audit

Favorites 0GitHub 0

detecting-process-injection-techniques

by mukul975

detecting-process-injection-techniques helps analyze suspicious in-memory activity, validate EDR alerts, and identify process hollowing, APC injection, thread hijacking, reflective loading, and classic DLL injection for Security Audit and malware triage.

Security Audit

Favorites 0GitHub 0

detecting-business-email-compromise

by mukul975

The detecting-business-email-compromise skill helps analysts, SOC teams, and incident responders identify BEC attempts using email-header checks, social-engineering clues, detection logic, and response-oriented workflows. Use it as a practical detecting-business-email-compromise guide for triage, validation, and containment.

Incident Response

Favorites 0GitHub 6.1k

detecting-email-forwarding-rules-attack

by mukul975

The detecting-email-forwarding-rules-attack skill helps Security Audit, threat hunting, and incident response teams find malicious mailbox forwarding rules used for persistence and email collection. It guides analysts through Microsoft 365 and Exchange evidence, suspicious rule patterns, and practical triage for forwarding, redirect, delete, and hide behaviors.

Security Audit

Favorites 0GitHub 0