Dnr Respond
Incident response workup for a lead in hand, an alert, an IOC, or a /dnr-hunt finding.
Install
npx skills add anthropics/defending-code-reference-harness --skill dnr-respond -g -a claude-code -y- Repository
- anthropics/defending-code-reference-harness7.7k
- Category
- Engineering
- Updated
- 3mo ago
- License
- See repository
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Incident response workup for a lead in hand, an alert, an IOC, or a /dnr-hunt finding. Scopes the lead across the logs, verdicts whether the attack succeeded, quantifies blast radius, confirms root cause in source with a local PoC, and writes a proposed (never executed) containment/remediation/recovery plan. Use when asked to "respond to this alert", "work this incident", "how bad is this", or "run dnr-respond". /dnr-hunt is the no-alert entry to the same track.
dnr-respond
Lead-in-hand incident response: take one concrete starting point and answer the four questions an incident commander needs, in order, what happened, did it succeed, how far did it go, and what do we do about it. The output is a verdict, a quantified blast radius, a root cause proven in source, and a response plan that is proposed, never executed.
Invoke with /dnr-respond <lead> [--logs dir] [--repo path] [--fresh].
The lead ($1) can be:
- an incident id from the hunt's
INCIDENTS.json(e.g.INC-2), the/dnr-hunthandoff - an alert pasted from an alert queue (JSON line or prose)
- an IOC: an IP, an account name, a route, a session identifier
- free text ("a customer says their address was quoted in a phishing email")
Other arguments:
--logs= logs directory or dnr target directory (same resolution as/dnr-hunt; defaults totargets/dnrcanaryif it exists, else cwd).--repo= application source (defaults to the target'sapp/).--fresh= ignore any checkpoint in the run dir's.dnr-respond-state/and mint a new run dir.
