What does the Dragan skill do?

Run incident response: scope, contain, eradicate, recover, with forensics, timeline and evidence handling. Load it once into Claude Projects and you get a configured Incident Responder without re-explaining context at the start of every session. Defensive security only. Always operate within authorized scope and your organization's rules of engagement, validate detections and controls in a lab or non-production environment first, and follow change control before touching production systems.

How do I install this skill file?

Download the .skill package (it contains SKILL.md), paste the contents into Claude Projects Instructions or your AI's system prompt, add your own context and start your first session. Works with Claude, ChatGPT, or any AI chat that accepts system prompts.

Which AI tools does this skill work with?

Works with Claude (recommended), ChatGPT, Gemini, Perplexity and Copilot, and any AI chat that accepts system prompts. Claude Projects gives the best results.

What is included in this download?

One .skill package delivered instantly after purchase: the full SKILL.md role configuration plus a worked-example file with a real scenario so you see the quality before you rely on it. No subscription, yours permanently.

How is this different from using Claude without the Dragan skill?

Without a skill file your AI starts every session as a general assistant. With Dragan loaded it applies Incident Responder methodology from the first message, with consistent quality every time. Defensive security only. Always operate within authorized scope and your organization's rules of engagement, validate detections and controls in a lab or non-production environment first, and follow change control before touching production systems.

Incident Responder (DFIR) AI Skill for Claude & ChatGPT

Name: Dragan — Incident Responder AI Skill
Brand: KissMySkills
Price: 34.0 USD
Availability: InStock

Dragan — Incident Responder AI Skill

$34.00

Dragan — Incident Responder AI Skill

$34.00

⚡ Instant download ◆ Claude & ChatGPT ∞ Keep forever

Instant download · 30-day money-back guarantee. Pay once, keep forever — no subscription. Refund policy

Run incident response: scope, contain, eradicate, recover, with forensics, timeline and evidence handling.

The IR lifecycle (NIST 800-61 / PICERL)
Containment, eradication and recovery without losing evidence
Forensic triage: disk, memory, network, cloud; timeline analysis
Chain of custody, ransomware/BEC response, post-incident review

Incident responders and blue teams who want a calm, evidence-safe response, not panic.An incident responder bills $120+/hr, this is one file, yours forever.

// what's inside

Drop Dragan into Claude and get a senior incident responder who scopes a breach, contains it without destroying evidence, and gets you to recovery.

Dragan runs incident response by the book (NIST 800-61 / PICERL): scoping and triage, containment, eradication and recovery, forensic triage of disk, memory, network and cloud artifacts, timeline analysis, chain of custody, ransomware and BEC response, and the post-incident review. Defensive only. Always work within authorized scope and chain-of-custody rules, preserve evidence, and coordinate before production-affecting containment.

What you get

→The IR lifecycle (NIST 800-61 / PICERL)
→Containment, eradication and recovery without losing evidence
→Forensic triage: disk, memory, network, cloud; timeline analysis
→Chain of custody, ransomware/BEC response, post-incident review

📄 dragan-incident-responder.skill Under 2 min install Works with Claude, ChatGPT & any AI chat

How to install

Download the .skill package → open Claude → paste SKILL.md into your Project Instructions or system prompt → describe your requirement → Dragan builds the answer. Includes a full worked example so you see exactly what you get.

dragan-incident-responder.skill

# Dragan — Incident Responder

You are Dragan, a senior incident responder (DFIR). You scope a breach, contain it without destroying evidence, and get to recovery. Defensive only.

## How you work
1. Validate and scope the incident; preserve evidence
2. Contain, eradicate, recover (NIST 800-61 / PICERL)
3. Build the timeline; keep chain of custody
4. Run the post-incident review; coordinate before prod actions

Defensive only: work within authorized scope and chain-of-custody, and coordinate before containment that affects production.

Excerpt from the actual file you'll download.

// try it

prompt

$We have a phishing-led endpoint compromise. Walk me through containment to recovery without wrecking the evidence.

Dragan returns the scoping, the evidence-preserving containment, eradication and recovery steps, an ATT&CK-mapped timeline, the chain-of-custody log, and a post-incident review, defensive and coordinated with stakeholders.

// how to install Under 2 minutes

Four steps. Any AI chat.

01
Download the file
After checkout, the download link lands in your inbox. Save the file anywhere on your device.
02
Open your AI chat
Claude, ChatGPT, Gemini, Grok, or Copilot — whichever one you already use.
03
Paste the file contents
Drop it into the system prompt, Project instructions, or custom instructions field.
04
Start working
Your AI is now configured as a specialist. Ask it anything inside its domain.