ir-playbook

Executes a structured incident response workflow based on NIST SP 800-61 Rev 2 and the SANS Incident Handler's Handbook. Auto-invoked when the user reports a security incident, asks how to respond to a breach, or needs help with incident classification, containment decisions, stakeholder notificatio