A structured process management skill for coordinating network incidents from detection through blameless post-incident reviews following NIST 800-61 standards.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install incident-response-lifecycle
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install incident-response-lifecycle using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Incident Response Lifecycle?
The Incident Response Lifecycle skill provides a rigorous framework for managing the organizational coordination layer of network incidents. It guides teams through severity classification, escalation matrices, and stakeholder communication without getting bogged down in the technical minutiae of forensics. By following this standardized approach, organizations can ensure that every critical event is handled with the appropriate level of urgency and structural integrity.
Built for high-stakes environments, this Openclaw Skills contribution focuses on the human and process elements of recovery. It ensures that role assignments like Incident Commander and Scribe are clear, that communication cadences are maintained, and that every incident concludes with a data-driven, blameless post-mortem to prevent future recurrence.
Incident Response Lifecycle Use Cases
- Service-affecting incident declaration (P1/P2) requiring formal command structures.
- Determining escalation paths and stakeholder notification timing.
- Multi-team investigation coordination across network, security, and infra teams.
- Managing external communication obligations for SLA breaches or data exposure.
- Facilitating 5-whys root cause analysis and blameless post-mortems.
- Tracking operational metrics like MTTD, MTTI, and MTTR for reporting.
How Incident Response Lifecycle Works
- Detection and Classification: Categorize the event by severity (P1-P4), type, and scope using the Threshold Tables.
- Triage and Escalation: Assign critical roles (IC, Tech Lead, Comms, Scribe) and trigger notifications based on the escalation matrix.
- Investigation Coordination: Task teams with evidence collection and maintain a running Hypothesis Tracker.
- Communication Management: Execute stakeholder updates using standardized templates and manage the incident bridge call.
- Resolution and Recovery: Implement validated fixes, perform phased restoration, and enter an enhanced monitoring period.
- Post-Incident Review: Conduct a 5-whys analysis within 72 hours and document systemic improvements.
Incident Response Lifecycle Setup
To utilize this skill, ensure you have the necessary authority to assign roles and access to your organization's contact directory.
# Example: Initializing the incident tracking environment
# Ensure ssh is available for remote coordination if needed
ssh -version
# Reference the internal templates for immediate notification
cat references/communication-templates.md
Incident Response Lifecycle Data Schema & Taxonomy
The skill organizes incident data into a structured format for both real-time tracking and historical analysis:
| Data Component | Description |
|---|---|
| Incident Metadata | ID, Severity, Commander, and Status (Resolved/Monitoring). |
| Impact Summary | Affected users, services, revenue impact, and data risk levels. |
| Timeline of Events | A chronological log of detections, actions, and discoveries. |
| Root Cause Analysis | 5-whys breakdown categorized by Process, People, or Technology. |
| Performance Metrics | Quantitative data including MTTD, MTTI, and MTTR. |
Incident Response Lifecycle Advanced Features
- Multi-role coordination support (Incident Commander, Tech Lead, Comms Lead, Scribe).
- Severity-based escalation automation and response SLA tracking.
- 5-whys root cause analysis methodology integration.
- Standardized communication templates for executive and customer-facing updates.
- Phased restoration workflows to prevent cascading failures during recovery.
SKILL.md
Loading
Related Openclaw Skills
Skillhub Preference
A policy-driven skill that prioritizes Skillhub for discovery and installation while maintaining a reliable fallback to Clawhub.
Luma AI Video Generation Assistant
A specialized expert skill for mastering Luma AI Dream Machine to generate high-fidelity cinematic videos from text and images.
Color Toolkit
A zero-dependency Python CLI tool for sophisticated color conversion, accessibility auditing, and palette orchestration.
Newsletter Growth Hacker
A professional toolkit for newsletter creators to optimize content, automate A/B testing, and implement data-driven subscriber growth strategies.
Value Chain Analysis
A strategic mapping tool that identifies value creation and capture across the entire industry lifecycle.
Product Fruits
An integration for managing Product Fruits data and user engagement tools through the Membrane-powered Openclaw Skills framework.
Featured*
