{
  "id": "skill-area:incident-response-forensics",
  "_kind": "SkillArea",
  "_file": "domain/skill-areas/curated-domain-task-skill-areas.yaml",
  "_cluster": "domain",
  "attributes": {
    "displayName": "Incident Response and Forensics",
    "description": "Responding to security events with evidence discipline - containment,\ntimeline reconstruction, root-cause analysis, and post-incident review.\n",
    "domains": [
      "domain:cybersecurity",
      "specialization:devops-sre-platform"
    ],
    "expertiseLevels": [
      "intermediate",
      "expert"
    ]
  },
  "outgoingEdges": [
    {
      "from": "skill-area:incident-response-forensics",
      "to": "domain:cybersecurity",
      "kind": "applies_to",
      "attributes": {
        "confidence": "primary"
      }
    },
    {
      "from": "skill-area:incident-response-forensics",
      "to": "specialization:devops-sre-platform",
      "kind": "applies_to",
      "attributes": {
        "confidence": "secondary"
      }
    },
    {
      "from": "skill-area:incident-response-forensics",
      "to": "skill-area:incident-response",
      "kind": "requires_skill_area"
    }
  ],
  "incomingEdges": [
    {
      "from": "skill-area:application-security",
      "to": "skill-area:incident-response-forensics",
      "kind": "prerequisite_for_learning",
      "attributes": {
        "strength": "recommended"
      }
    },
    {
      "from": "lib-agent:cryptography-blockchain--incident-response",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 1
      }
    },
    {
      "from": "lib-agent:security-compliance--forensic-analysis-agent",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 1
      }
    },
    {
      "from": "lib-agent:security-compliance--trojan-detection-agent",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 0.7
      }
    },
    {
      "from": "lib-agent:security-research--malware-analyst",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 1
      }
    },
    {
      "from": "lib-skill:cryptography-blockchain--bug-bounty",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 0.5
      }
    },
    {
      "from": "lib-skill:cryptography-blockchain--chain-forensics",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 0.7
      }
    },
    {
      "from": "lib-skill:security-compliance--git-forensics-scanner",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 1
      }
    },
    {
      "from": "lib-skill:security-research--incident-forensics",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 1
      }
    },
    {
      "from": "lib-skill:security-research--security-sandbox",
      "to": "skill-area:incident-response-forensics",
      "kind": "lib_requires_skill_area",
      "attributes": {
        "weight": 0.7
      }
    },
    {
      "from": "role:soc-analyst",
      "to": "skill-area:incident-response-forensics",
      "kind": "requires_expertise",
      "attributes": {}
    },
    {
      "from": "role:forensic-analyst",
      "to": "skill-area:incident-response-forensics",
      "kind": "requires_expertise",
      "attributes": {}
    },
    {
      "from": "workflow:security-incident-response",
      "to": "skill-area:incident-response-forensics",
      "kind": "requires_skill_area",
      "attributes": {}
    }
  ]
}