A playbook-driven incident response framework providing structured security workflows, evidence collection, and BlackArch forensic tool integration.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install incident-responder
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install incident-responder using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Incident Responder?
Incident Responder is a robust, playbook-driven incident response framework designed for the ARGUS infrastructure. It empowers security administrators and AI agents to execute structured workflows during active security incidents, including compromised data exfiltration, ransomware attacks, and credential exposure. By integrating directly with BlackArch forensics tools, CVE-MCP, and network recon utilities like aynops, this tool accelerates threat analysis and containment.
Leveraging these advanced Openclaw Skills, developers and security operations teams can enforce read-only evidence collection, reconstruct chronological event timelines, and automatically map threat behaviors to the MITRE ATT&CK framework. Whether running manual diagnostics or automating playbooks through agentic systems, it ensures immutable evidence tracking and secure recovery.
Incident Responder Use Cases
- Data Exfiltration Response: Verify exfiltration indicators, capture live network snapshots, and run packet captures using tshark during active data leaks.
- Ransomware Mitigation: Isolate infected hosts quickly without losing volatile memory, and safely write memory/disk dumps to an immutable evidence store.
- Credential Audit: Parse authentication logs to identify unauthorized lateral movement, trace failed/successful root attempts, and audit SSH keys.
- Simulated Tabletop Training: Run simulated security scenarios using structured playbooks to uncover bottlenecks in system logging and containment times.
How Incident Responder Works
- Triage Trigger: On declaration of an incident, the tool runs a diagnostic system snapshot, logging listening ports, active sessions, and processes.
- Evidence Preservation: Forensic artifacts (logs, memory dumps, PCAP captures) are written to a localized directory and cryptographically hashed for chain-of-custody compliance.
- Threat Intel Enrichment: Integrates with CVE-MCP to check for active vulnerabilities and queries aynops for IP reputation scoring of external endpoints.
- Containment Execution: Employs containment scripts to block malicious IPs via firewalls, terminate active malicious connections, or quarantine the compromised host.
- Timeline Reconstruction: Compiles multiple system log formats into a single, chronologically sorted JSONL event stream to reveal attacker lateral movement.
- Post-Incident Reporting: Outputs an in-depth incident report template detailing initial access vectors, IOC inventory, and a MITRE ATT&CK tactical map.
Incident Responder Setup
Prerequisites
- ARGUS Host running Linux with root/sudo access for forensics tool deployment.
- CVE-MCP and aynops active on your localhost or network endpoints.
- Basic commands available on path:
curl,jq,grep,awk.
Core Installation
To install advanced forensics and network analysis tools via the BlackArch repository package wrapper:
cd ~/App/domains/argus/tools
./manage-blackarch.sh install volatility3 tshark autopsy sleuthkit bulk_extractor
Environment Configuration
Ensure the following parameters are mapped in your active setup configuration:
EVIDENCE_DIR: Target path for immutable forensics (defaults to~/App/domains/argus/evidence).IR_ALERT_WEBHOOK: Slack or Discord webhook for urgent incident alerts.
Incident Responder Data Schema & Taxonomy
Generated File Layout
All evidence collected by Openclaw Skills is structured logically under the configured evidence storage directory:
| Location / Filename | Data Format | Description |
|---|---|---|
~/App/domains/argus/evidence/ir-[TIMESTAMP]/ |
Directory | Per-incident workspace folder. |
uname.txt |
Plain Text | Captured system kernel and architecture metadata. |
listening-ports.txt |
Plain Text | Diagnostic network listening sockets. |
timeline.jsonl |
JSON Lines | Chronological merge of auth, command, and network logs. |
incident-report.md |
Markdown | Comprehensive post-incident review and MITRE ATT&CK mapping. |
~/App/domains/argus/evidence/objects/ |
Repository | Destination for high-integrity, write-once raw memory and disk images. |
Parameter Schema
| Variable | Default Value | Description |
|---|---|---|
RETENTION_DAYS |
90 |
Lifetime in days of stored evidence files before rotation. |
AUTH_LOG |
/var/log/auth.log |
Core authentication trace parsed for logins and sudo usage. |
Incident Responder Advanced Features
- Volatility3 Memory Analysis: Parse raw RAM dumps to extract active process maps, DLL injection traces, and command history automatically.
- Tshark Automated PCAP Inspection: Analyze captured packet data to filter HTTP requests, TLS handshake Server Name Indication (SNI), and DNS queries.
- Non-Destructive Workflows: Operates completely read-only during triage and evidence acquisition to preserve original systems metadata.
- Reputation Validation Pipelines: Scripted integration loops suspicious destination IPs from traffic logs straight into reputation engines to flag known malware C2 nodes.
SKILL.md
Loading
Related Openclaw Skills
GDPR Security Auditor
An automated technical compliance skill to inventory data stores, identify PII leaks, verify system-wide encryption, and generate detailed GDPR audit reports.
Agent Input-Firewall
A privacy-first, ultra-fast prompt-injection and jailbreak firewall designed to protect autonomous AI agents from untrusted external text inputs.
Luoshenfu Literary Research Skill
An advanced AI-driven research skill designed to generate comprehensive, academically rigorous literary analyses of the classic Chinese masterpiece 'Ode to the Goddess of Luo River' (洛神赋) and its profound cultural connections.
Troubleshooting Computer Issues
A platform-agnostic diagnostics and debugging engine designed to systematically identify, resolve, and document computer configuration failures, software errors, and runtime issues.
LYGO Second Brain
A local, LLM-powered second brain and wiki that combines Obsidian markdown vaults with Ollama inference, semantic search, and multi-model consensus.
DataEcho
Deploy files, static sites, and containerized server-side apps to live URLs straight from your AI coding agent, powered by secure Drives for persistent memory.
Featured*
