Incident Response Dashboard Builder
Builds live incident dashboards in Splunk, Elastic or Grafana for responders and leadership.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 4 files
What it does
When installed, the agent can design a dashboard for tracking an active security incident. It provides ready-made layouts and search queries that show affected systems, containment progress, indicators of compromise (IOCs), a response timeline, and SOC performance metrics like detection and response times. It also includes a Python helper that can query a Splunk instance to pull incident summaries and affected-system data.
Great for
- SOC teams setting up a shared view during an active incident
- Security engineers who already run Splunk and want starter dashboard searches
- Leadership teams that need incident status and metrics for briefings
Skip it if
- Day-to-day SOC monitoring, where the skill itself says the built-in Incident Review is the better choice
- Anyone without a SIEM such as Splunk, Elastic or Grafana, since the queries will not run elsewhere
- Teams who would run the bundled script against a production Splunk without reviewing it first, because it connects with a username and password and runs searches
Try asking
- “Build a Splunk Dashboard Studio view for incident IR-2024-0450 showing affected hosts and containment status”
- “Write SPL searches that track IOC spread across our indices over the last week”
- “Create an incident timeline panel from a CSV of analyst actions”
- “Generate SOC metrics panels for MTTD, MTTR and analyst workload from notable events”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 4 original files, the Apache-2.0 licence and an attribution note.
building-incident-response-dashboard.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip building-incident-response-dashboard.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip building-incident-response-dashboard.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/agent.py before running it, and use a read-only Splunk account with limited scope
- Replace the sample IOCs, hostnames, hashes and incident IDs in the examples with your own values before deploying
- Test the searches on a non-production index first, since some examples use broad index=* searches over long time ranges
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.es.md
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.