incident-validation-correlation
From the author
Correlates supplied sanitized incident observations with separately approved isolated defensive-validation receipts across prevent, observe, detect, contain, and recover. Use for defensive learning comparison without live response, hunting, technique design or execution, detection authoring, case management, findings, or reporting.
Install
npx skills add zero-lab-ai/skills --skill incident-validation-correlation -a claude-code
Installs to .claude/skills/incident-validation-correlation/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 85
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- assessment-sequence-governancezero-lab-ai/skillsValidates supplied immutable ordered manifests of opaque defensive assessment actions for authority, safeguards, evidence, and separate-operator review. Use when reviewing assessment sequencing without creating, changing, or executing actions.Engineering★ 281
- incident-responsecbrock84/headcountRuns a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or when a breach may trigger notification obligations.Security★ 2.1K
- binary-fault-validation-readinesszero-lab-ai/skillsGoverns an exact current binary-fault-triage assessment result and recorded validation-readiness handoff for separate isolated-lab review. Use when checking defensive authority, isolation, budget, stop, cleanup, custody, and independent-review readiness without analyzing faults, creating tests or inputs, determining exploitability, or authorizing execution or development.Testing★ 281
- command-channel-defense-assessmentzero-lab-ai/skillsAssesses supplied defensive evidence for prevention, visibility, detection, containment, and recovery coverage against opaque command-channel scenarios. Use when reviewing command-and-control exposure or control gaps without designing infrastructure, live tests, or operational guidance.Testing★ 281
- detection-and-monitoringcbrock84/headcountBuilds the capability to notice an attack in progress — deciding what to log and retain, centralizing it somewhere tamper-resistant, writing detections that fire on attacker behavior rather than on individual events, tuning out the noise that trains people to ignore alerts, and defining what happens when something fires. Use this to design or assess monitoring coverage, work out why an incident went unnoticed, cut alert volume without losing signal, or decide what a detection capability should cost.Design★ 2.1K
- defensive-control-evidence-synthesiszero-lab-ai/skillsSynthesizes supplied evidence-backed defensive assessment results and administrative receipts into a scope-bound control-evidence matrix that preserves lineage, freshness, contradictions, unknowns, and gaps. Use when consolidating defensive control evidence without scanning, scoring, certifying, or rewriting findings.Other★ 281
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in