Contents

Install
SKILL.md (verbatim)
When to Use
Prerequisites
Workflow
Step 1: Gather Incident Data
Step 2: Conduct Blameless Post-Mortem Meeting
Step 3: Perform Root Cause Analysis
Step 4: Calculate Response Metrics
Step 5: Document Findings and Create Action Items
Step 6: Update Playbooks and Detection Rules
Key Concepts
Tools & Systems
Common Scenarios
Output Format
Other files in this skill
assets/template.md (verbatim)
Incident Information
Incident Summary
Response Metrics
Timeline
What Worked Well
What Needs Improvement
Root Cause Analysis (5 Whys)
Action Items
Playbook Updates Required
Detection Improvements
Participants
Meeting Notes
Approval
references/api-reference.md (verbatim)
Libraries
Key Metrics
NIST SP 800-61 Phases
Report Template Sections
External References
references/standards.md (verbatim)
NIST SP 800-61 Rev. 2 - Section 3.4 Post-Incident Activity
NIST SP 800-61 Rev. 3 - Continuous Improvement
SANS PICERL - Lessons Learned Phase
MITRE ATT&CK - Detection Gap Analysis
ISO 27001 - Clause 10: Improvement
Google SRE Post-Mortem Culture
references/workflows.md (verbatim)
Pre-Meeting Preparation (1-3 days before)
Meeting Facilitation Guide
Ground Rules
Discussion Framework
Key Metrics Framework
Action Item Categories
Process
Technology
People
Follow-Up Schedule

What it does. Facilitate structured post-incident reviews to identify root causes, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).


Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/conducting-post-incident-lessons-learned/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill conducting-post-incident-lessons-learned, or copy the skill folder into ~/.claude/skills/conducting-post-incident-lessons-learned/.
Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/conducting-post-incident-lessons-learned/SKILL.md

SKILL.md (verbatim)

name: conducting-post-incident-lessons-learned
description: Facilitate structured post-incident reviews to identify root causes,
  document what worked and failed, and produce actionable recommendations to improve
  future incident response.
domain: cybersecurity
subdomain: incident-response
tags:
- incident-response
- lessons-learned
- post-incident
- after-action-review
- process-improvement
mitre_attack:
- T1566
- T1486
- T1059
- T1078
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- RS.MA-01
- RS.MA-02
- RS.AN-03
- RC.RP-01

Conducting Post-Incident Lessons Learned

When to Use

After any security incident has been fully resolved and recovery completed
Following tabletop exercises or IR simulations
After significant near-miss events
Quarterly review of accumulated incident trends
When IR playbooks need updating based on real-world experience

Prerequisites

Incident fully resolved (containment, eradication, recovery complete)
Incident timeline and documentation gathered
All incident responders available for review session
Meeting space for collaborative discussion
Incident ticketing system data for metrics analysis

Workflow

Step 1: Gather Incident Data

# Export incident timeline from ticketing system
curl -s "https://thehive.local/api/v1/case/$CASE_ID/timeline" \
  -H "Authorization: Bearer $THEHIVE_API_KEY" | jq '.' > incident_timeline.json

# Extract detection and response metrics from SIEM
index=notable incident_id="IR-2024-042"
| stats min(_time) as first_alert, max(_time) as last_alert,
  count as total_alerts, dc(src) as unique_sources

# Compile all responder actions and timestamps
grep -E "timestamp|action|analyst" /var/log/ir/IR-2024-042/*.json | \
  python3 -m json.tool > compiled_actions.json

Step 2: Conduct Blameless Post-Mortem Meeting

Structured Agenda (90 minutes):
1. Incident summary (5 min) - Factual overview
2. Timeline walkthrough (20 min) - Chronological events
3. What worked well (15 min) - Positive outcomes
4. What needs improvement (15 min) - Gaps and failures
5. Root cause analysis (15 min) - 5 Whys or fishbone
6. Action items (10 min) - Specific improvements with owners
7. Playbook updates (10 min) - Changes to IR procedures

Blameless Principles:
- Focus on systems and processes, not individuals
- Assume best intentions with available information
- Seek to understand, not to blame

Step 3: Perform Root Cause Analysis

# 5 Whys analysis example:
# Why 1: Why did ransomware encrypt production servers?
#   Answer: Attacker had domain admin credentials
# Why 2: Why did attacker have domain admin credentials?
#   Answer: Kerberoasted a service account and cracked it
# Why 3: Why was the service account password crackable?
#   Answer: Used a 12-character dictionary-based password
# Why 4: Why was the service account password weak?
#   Answer: No enforcement of service account password policy
# Why 5: Why was there no service account password policy?
#   Answer: PAM was not implemented for service accounts
# ROOT CAUSE: Lack of privileged access management

Step 4: Calculate Response Metrics

from datetime import datetime
events = {
    'compromise': '2024-01-10 14:00:00',
    'detection': '2024-01-15 08:30:00',
    'triage': '2024-01-15 08:45:00',
    'containment': '2024-01-15 09:30:00',
    'eradication': '2024-01-16 14:00:00',
    'recovery': '2024-01-18 16:00:00',
    'closure': '2024-01-25 10:00:00',
}
fmt = '%Y-%m-%d %H:%M:%S'
times = {k: datetime.strptime(v, fmt) for k, v in events.items()}
print(f"Dwell Time: {times['detection'] - times['compromise']}")
print(f"MTTD: {times['triage'] - times['detection']}")
print(f"MTTC: {times['containment'] - times['detection']}")
print(f"MTTR: {times['recovery'] - times['eradication']}")
print(f"Total Duration: {times['closure'] - times['detection']}")

Step 5: Document Findings and Create Action Items

# Create tracked action items in project management
curl -X POST "https://jira.local/rest/api/2/issue" \
  -H "Authorization: Bearer $JIRA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "fields": {
      "project": {"key": "SEC"},
      "summary": "Implement PAM for service accounts (IR-2024-042)",
      "issuetype": {"name": "Task"},
      "priority": {"name": "High"},
      "assignee": {"name": "security_engineer"},
      "duedate": "2024-03-15"
    }
  }'

Step 6: Update Playbooks and Detection Rules

# New Sigma detection rule based on incident learnings
title: Kerberoasting Activity Detected
status: stable
description: Detects Kerberoasting based on IR-2024-042 lessons
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4769
    TicketEncryptionType: '0x17'
  condition: selection
level: high
tags:
  - attack.credential_access
  - attack.t1558.003

Key Concepts

Concept	Description
Blameless Post-Mortem	Reviewing incidents focusing on systems, not blaming individuals
Root Cause Analysis	Identifying the fundamental reason the incident occurred
5 Whys	Iterative questioning technique to find root cause
MTTD	Mean Time to Detect - time from compromise to detection
MTTC	Mean Time to Contain - time from detection to containment
MTTR	Mean Time to Recover - time from eradication to full recovery
Continuous Improvement	Iterating on IR processes based on real incident data

Tools & Systems

Tool	Purpose
TheHive/ServiceNow	Incident timeline and documentation
Jira/Azure DevOps	Action item tracking
Confluence/SharePoint	Lessons learned documentation
Splunk/Elastic	Incident metrics and detection improvement
Sigma	Detection rule development

Common Scenarios

Ransomware Post-Mortem: Review entire kill chain from initial access to encryption. Identify detection gaps and backup failures.
Phishing Campaign Review: Analyze why users clicked, why email filters missed it, and how to improve training.
Cloud Misconfiguration Incident: Review IaC pipeline, CSPM coverage, and change management process.
Insider Threat Review: Examine DLP effectiveness, access control gaps, and user monitoring capabilities.
Third-Party Breach Impact: Review vendor risk assessment process and data sharing agreements.

Output Format

Post-incident review meeting minutes
Root cause analysis document
Incident metrics report (MTTD, MTTC, MTTR)
Action items list with owners and deadlines
Updated IR playbooks and detection rules
Executive summary for leadership

Other files in this skill

assets/template.md (verbatim)

Post-Incident Lessons Learned Report

Incident Information

Field	Value
Incident ID
Incident Type
Severity
Date Detected
Date Resolved
Review Date
Facilitator

Incident Summary

[Brief factual description of the incident]

Response Metrics

Metric	Target	Met Target
Dwell Time	< 24 hours	Yes/No
MTTD (Detection to Triage)	< 15 min	Yes/No
MTTC (Detection to Containment)	< 4 hours	Yes/No
Eradication Duration	< 24 hours	Yes/No
MTTR (Eradication to Recovery)	< 48 hours	Yes/No
Total Incident Duration	< 7 days	Yes/No

Timeline

Date/Time (UTC)	Event	Actor
	Initial compromise (estimated)	Threat actor
	First alert generated	SIEM/EDR
	Triage completed	SOC analyst
	Incident declared	IR lead
	Containment achieved	IR team
	Eradication completed	IR team
	Recovery completed	IT ops
	Incident closed	IR lead

What Worked Well

What Needs Improvement

Root Cause Analysis (5 Whys)

Level	Question	Answer
Why 1
Why 2
Why 3
Why 4
Why 5

Root Cause: [Summary]

Action Items

ID	Priority	Category	Status
1	High/Med/Low	Process/Tech/People	Open
2
3

Playbook Updates Required

Playbook	Change Description	Owner	Deadline

Detection Improvements

Rule Name	Description	MITRE Technique	Priority

Participants

Name	Role	Present
	Incident Commander	Yes/No
	SOC Analyst	Yes/No
	IR Lead	Yes/No
	CISO	Yes/No

Meeting Notes

[Key discussion points and decisions]

Approval

Role	Name	Date
IR Lead
CISO

references/api-reference.md (verbatim)

Post-Incident Lessons Learned — API Reference

Libraries

Library	Install	Purpose
requests	`pip install requests`	API calls to ticketing/SIEM systems
jinja2	`pip install Jinja2`	Report template rendering
matplotlib	`pip install matplotlib`	Timeline and metric visualization

Key Metrics

Metric	Formula	Target
MTTD	Detection time - Incident start	< 30 minutes
MTTC	Containment time - Detection time	< 60 minutes
MTTR	Resolution time - Detection time	< 4 hours
Dwell Time	Detection time - Initial compromise	< 24 hours

NIST SP 800-61 Phases

Phase	Activities
Preparation	Playbooks, tools, training
Detection & Analysis	Alert triage, scoping, evidence collection
Containment	Short-term and long-term isolation
Eradication & Recovery	Root cause removal, system restoration
Post-Incident	Lessons learned, action items, metrics

Report Template Sections

Section	Content
Executive Summary	Impact, scope, duration
Timeline	Chronological event sequence
Root Cause	5-Whys or fishbone analysis
Action Items	Prioritized P1/P2/P3 with owners

External References

references/standards.md (verbatim)

Standards References - Post-Incident Lessons Learned

NIST SP 800-61 Rev. 2 - Section 3.4 Post-Incident Activity

3.4.1: Lessons Learned meetings after each significant incident
3.4.2: Using Collected Incident Data for trending and metrics
Recommends formal review within days of resolution

NIST SP 800-61 Rev. 3 - Continuous Improvement

Recover (RC) function: Learning from incidents
RC.CO-03: Recovery activities and progress communicated
Emphasis on continuous improvement of IR capabilities

SANS PICERL - Lessons Learned Phase

Phase 6: Final phase of incident handling
Formal review with all stakeholders
Document improvements and update procedures

MITRE ATT&CK - Detection Gap Analysis

Map incident techniques to ATT&CK framework
Identify detection gaps in current monitoring
Develop new detection rules based on observed TTPs

ISO 27001 - Clause 10: Improvement

10.1: Nonconformity and corrective action
10.2: Continual improvement
Requires organizations to learn from security incidents

Google SRE Post-Mortem Culture

Blameless approach to incident review
Focus on systemic issues rather than human error
Document and share learnings broadly

references/workflows.md (verbatim)

Post-Incident Lessons Learned - Detailed Workflow

Pre-Meeting Preparation (1-3 days before)

Compile complete incident timeline from all sources
Gather all communication logs (email, chat, phone)
Export incident metrics from ticketing system
Collect detection data from SIEM/EDR
Identify all participants and send calendar invites

Meeting Facilitation Guide

Ground Rules

Blameless discussion - focus on processes and systems
Everyone's perspective is valued equally
Objective review of facts, not opinions
All observations documented in real-time
Action items must have owners and deadlines

Discussion Framework

What was the incident? (5 min) - Brief factual summary
Walk the timeline (20 min) - Chronological event review
What went well? (15 min) - Effective actions and decisions
What could improve? (15 min) - Gaps and failures
Root cause deep dive (15 min) - 5 Whys or fishbone diagram
Action items (10 min) - Assigned improvements
Playbook updates (10 min) - Procedural changes

Key Metrics Framework

Metric	Formula	Industry Benchmark
Dwell Time	Detection - Initial Compromise	Median: 10 days (Mandiant)
MTTD	Triage Complete - First Alert	Target: < 15 min (P1)
MTTC	Containment Complete - Detection	Target: < 4 hours
MTTR	Recovery Complete - Eradication	Target: < 48 hours
Total Duration	Closure - Detection	Target: < 7 days

Action Item Categories

Process

Updated playbooks and runbooks
Communication plan updates
Escalation criteria changes

Technology

New detection rules
Tool improvements
Monitoring expansion
Automation opportunities

People

Training needs
Staffing gaps
Cross-training requirements

Follow-Up Schedule

1 week: Action items tracked in project system
1 month: First progress review
3 months: Validate improvements with tabletop
6 months: Re-evaluate metrics

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.

conducting-post-incident-lessons-learned skill (Anthropic-Cybersecurity-Skills)