Open the folder
Choose the working folder that holds your procedures, and pick Ask first so any change waits for your OK.
Workflows
NIST incident response framework: check your procedure step by step
03
Compare one procedure with public guidance
The NIST incident response framework here means SP 800-61, NIST's incident handling guide with 4 phases. Pick one procedure. Compare it with those phases, starting with the section that is your team's biggest pain point in incident management, and note the gaps.
Read the public guide
Ask the agent to read the guidance with web_search and http_get, and to list its phases in a notes file.
Compare the phases
The agent reads your procedure with read_file and grep, then lists which phases it covers and which it never mentions.
Review the diff
Read each proposed edit as a diff, accept the ones that fit your organisation, and reject the rest.
A short checklist the agent can write
Compare docs/triage.md with the phases in the public guide and list what is missing.
- web_search
NIST SP 800-61 phases3 results - http_get
nist.gov SP 800-61 pagefetched - read_file
docs/triage.mdread - grep
recovery0 matches - edit_file
docs/triage.md+8 lines
Waiting for your OK before the next stepRejectAccept
ir-checklist.md
# Incident checklist
## Prepare
- [ ] Review the contact list and owners
- [ ] Confirm the backup channel is written down
## Triage
- [ ] Open an incident record with date and time
- [ ] Note who reported it and how
## Contain
- [ ] Record who approves each decision
- [ ] Note times and keep copies of logs
## Communicate
- [ ] Tell the people listed in the plan
## Review
- [ ] Hold a review and assign owners and datesThe file is short. A small team can keep a checklist like this on one page, with 5 phase headings and a few task lines each, and grow it into a cyber response plan later.
Cross-check a draft against the SANS incident response framework
Compare the steps of two public guides
The SANS incident response framework is usually taught as six steps: preparation, identification, containment, eradication, recovery and lessons learned. Ask the agent to put those steps next to the 4 phases of SP 800-61 in a table. web_search finds the pages and http_get fetches one page at a time. Then read_file opens your procedure and grep looks for each step by name, so the result is a table of steps your document names and steps it leaves out. Nothing is edited yet. Read the table yourself, and decide with colleagues which gaps matter before any edit.
Add who is told, when and how
A communication plan answers who is told, when, by whom and through which channel, and a backup channel should not depend on the systems that may be affected. If you vet third party vendors, ask each one for an incident contact and add it to the list, because an incident at a supplier can affect your own systems. read_file opens the list and edit_file adds a communication section for management, IT, legal, HR, affected staff, customers and authorities. Notification duties and deadlines differ by country and sector, so confirm them with counsel; this is not legal advice. Ask first shows the diff. Then you call each contact once by hand to test the list.
