<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: triaging-security-incident
description: >-
  Automated security technique for triaging security incident within the incident-response domain. Provides analysis, scanning, and reporting capabilities for defensive and offensive security workflows.
domain: cybersecurity
subdomain: incident-response
tags:
  - incident-response
  - triaging
  - security-automation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Triaging Security Incident

## Quick Reference

| Item | Detail |
|---|---|
| Domain | incident-response |
| Technique | triaging-security-incident |
| ATT&CK | See metadata |
| Difficulty | Intermediate |

## Overview

Automated security technique for triaging security incident within the incident-response domain. Provides analysis, scanning, and reporting capabilities for defensive and offensive security workflows.

## Workflow

1. **Preparation** — Gather required tooling and access.
2. **Execution** — Run the technique using the agent script.
3. **Analysis** — Review output and correlate findings.
4. **Reporting** — Document results and remediation steps.

## Verification

```bash
node scripts/agent.js analyze --target example
node scripts/agent.js report --format json
```

## References

- MITRE ATT&CK: https://attack.mitre.org/
- See `references/api-reference.md` for command details.
