Containment Playbooks
From the author
Ordered first-response containment sequences for the most common MSP incident classes — compromised account, malware/ransomware detection, business email compromise, and exposed credential — including why the order matters, which connected tool family (RMM, EDR, CIPP/Entra, PSA, documentation) handles each step, and the evidence-preservation principles that apply across all of them.
Install
npx skills add WYRE-AI/msp-claude-plugins --skill 'Containment Playbooks' -a claude-code
Installs to .claude/skills/Containment-Playbooks/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
Want your agent to suggest skills while you type? See how to use skills from your IDE.
Safety checks on SKILL.md
No warnings.
Why 82
aiqbench computes the trust score from public signals. It is not a security audit, so read a skill before you install it.
Similar skills
Closest to this one by what they do and when they are used.
- BEC ResponseWYRE-AI/msp-claude-pluginsBusiness Email Compromise detection and first response: the signals that reveal it in CIPP/M365 audit logs, mailbox and forwarding rules, and connected email security vendor alerts; the order-dependent response sequence (session revocation, forwarding-rule audit, mailbox rule and delegate cleanup, password reset, MFA re-enrollment, lateral-spread check, recipient notification); and what a defensible incident timeline must capture for insurance or bank-fraud claims.Security★ 50
- performing-ransomware-response26zl/cybersec-toolkitExecutes a structured ransomware incident response from initial detection through containment, forensic analysis, decryption assessment, recovery, and post-incident hardening. Addresses ransom negotiation considerations, backup integrity verification, and regulatory notification requirements. Activates for requests involving ransomware response, ransomware recovery, crypto-ransomware, data encryption attack, ransom payment decision, or ransomware containment.Security★ 84
- incident-responsecbrock84/headcountRuns a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or when a breach may trigger notification obligations.Security★ 2.1K
- building-soc-playbook-for-ransomware26zl/cybersec-toolkitBuilds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.Planning★ 84
- email-opsmturac/everything-openai-codexEvidence-first mailbox triage, drafting, send verification, and sent-mail-safe follow-up workflow for ecc. Use when the user wants to organize email, draft or send through the real mail surface, or prove what landed in Sent.Productivity★ 83
- containmentUnitOneAI/SecuritySkillsProvides structured incident containment strategies mapped to NIST SP 800-61 Rev 2 and MITRE ATT&CK techniques. Auto-invoked when a confirmed incident requires isolation decisions, credential revocation, network segmentation, or DNS sinkholing. Produces a containment plan with short-term and long-term actions, business impact assessment, and ATT&CK-mapped countermeasures.Planning★ 94
Ratings & reviews
—
no reviews
Tried this skill? Rate it to help others. Sign in
Discussion
Join the discussion. Sign in