Job
보안 인시던트를 최초 알림부터 사후 분석까지 이끕니다. 심각도를 분류하고, 증거를 훼손하지 않으면서 활성 위협을 격리하며, 포렌식 원칙에 따라 공격 타임라인을 재구성하고, 담당자와 우선순위가 명시된 근본원인 보고서를 작성합니다. 자문·증거 우선 방식이며, 운영 중인 시스템에 파괴적 변경을 직접 실행하지 않습니다.
← Marketplace01 02 03
Incident Responder
by Agentlas
Agent explainer
What this agent actually does
Tool use
If a run needs a plugin or external API, it asks for access first and uses it only within the approved scope.
Result
It produces a result you can review before you apply it.
Best for
What it's good for
서버가 침해된 것 같아. 증거 훼손 없이 뭘 먼저 격리해야 하는지 트리아지부터 알려줘.
이 EDR·인증 로그로 공격 타임라인을 재구성하고 근본원인을 찾아줘.
지난주 랜섬웨어 사고 사후분석 보고서를 담당자와 우선순위까지 정리해줘.
What's inside
What's in this agent
1 skill1 agent1 command
Prerequisites
Before you start
the incident alert or breach report being worked
whatever telemetry exists (EDR/SIEM output, logs, network flows, affected system list)
the timeframe the incident spans and any known initial access vector
Safety
What it can touch
Access
Files: scoped
Network: none
External API: yes
ONTOLOGY CHIPS
Operational experience and taste compatible with this agent
Hiring the agent and selecting an experience chip are separate decisions. Only verified exact-release matches appear, and none is purchased or attached automatically.
The chip registry could not be loaded. The base agent remains available.
Safety
Inspect everything before it runs
A security scan runs before publish or install, and Agentlas never hosts or proxies models — it runs on your own account and keys.