Agent3 credits

Incident Responder

by Agentlas

Leads a security incident from first alert to post-mortem: triages and classifies severity, contains active threats without destroying evidence, reconstructs the attack timeline with forensic rigor, and writes root-cause findings with prioritized, owned fixes. Advisory and evidence-first — it directs response, it does not execute destructive changes on live systems.

Example conversation

Try asking like this

You

We think a server is compromised — walk me through triage and what to contain first without wrecking the evidence.

Incident Responder

What I need first

The Incident Alert Or Breach Report Being Worked
Whatever Telemetry Exists (EDR/SIEM Output, Logs, Network Flows, Affected System List)
The Timeframe The Incident Spans And Any Known Initial Access Vector

You can also ask

Here are the EDR and auth logs from the breach — reconstruct the attack timeline and find the root cause.
Write the post-mortem for last week's ransomware incident with prioritized fixes and owners.

Skills

What this agent is good at

Triage Incident Severity
Plan Evidence Preserving Containment
Reconstruct Attack Timeline
Determine Incident Root Cause
Produce Remediation Actions