{
  "id": "lib-process:security-compliance--incident-response",
  "_kind": "LibraryProcess",
  "_file": "generated-library/processes.yaml",
  "_cluster": "generated-library",
  "attributes": {
    "displayName": "incident-response",
    "description": "Security Incident Response Plan - Comprehensive framework for handling security incidents including classification,\nresponse procedures, digital forensics, stakeholder communication, containment, eradication, recovery, and post-incident analysis\nto minimize damage and ensure systematic recovery from security breaches.",
    "libraryPath": "library/specializations/security-compliance/incident-response.js",
    "specialization": "security-compliance",
    "references": [
      "- NIST Computer Security Incident Handling Guide: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r2.pdf\n- SANS Incident Handler's Handbook: https://www.sans.org/white-papers/33901/\n- ISO/IEC 27035 - Incident Management: https://www.iso.org/standard/78973.html\n- CISA Incident Response Guide: https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf\n- FIRST Best Practices: https://www.first.org/resources/guides/"
    ],
    "example": "const result = await orchestrate('specializations/security-compliance/incident-response', {\n  incidentType: 'data-breach',\n  severity: 'critical',\n  affectedSystems: ['customer-database', 'web-application'],\n  detectionSource: 'siem-alert',\n  description: 'Unauthorized access detected to customer database with potential data exfiltration',\n  securityTeam: 'security-operations',\n  requiresForensics: true\n});",
    "usesAgents": [
      "incident-triage-agent",
      "general-purpose",
      "forensic-analysis-agent",
      "threat-intelligence-agent"
    ]
  },
  "outgoingEdges": [
    {
      "from": "lib-process:security-compliance--incident-response",
      "to": "domain:security",
      "kind": "lib_applies_to_domain",
      "attributes": {
        "weight": 1
      }
    },
    {
      "from": "lib-process:security-compliance--incident-response",
      "to": "skill-area:incident-management",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 1
      }
    },
    {
      "from": "lib-process:security-compliance--incident-response",
      "to": "workflow:incident-response",
      "kind": "lib_implements_workflow",
      "attributes": {
        "weight": 1
      }
    },
    {
      "from": "lib-process:security-compliance--incident-response",
      "to": "specialization:security-compliance",
      "kind": "lib_belongs_to_specialization",
      "attributes": {
        "weight": 0.9
      }
    },
    {
      "from": "lib-process:security-compliance--incident-response",
      "to": "lib-agent:security-compliance--incident-triage-agent",
      "kind": "uses_agent",
      "attributes": {
        "weight": 0.8
      }
    },
    {
      "from": "lib-process:security-compliance--incident-response",
      "to": "lib-agent:security-compliance--forensic-analysis-agent",
      "kind": "uses_agent",
      "attributes": {
        "weight": 0.8
      }
    },
    {
      "from": "lib-process:security-compliance--incident-response",
      "to": "lib-agent:security-compliance--threat-intelligence-agent",
      "kind": "uses_agent",
      "attributes": {
        "weight": 0.8
      }
    }
  ],
  "incomingEdges": []
}