ot-incident-triagelisted

## When to Use - First-hour response to an OT alert before a full investigation exists. - Operator report of unexplained process behavior or controller state changes. - Enterprise SOC notification with a confirmed path into OT. - Deciding between isolation and monitoring when information is incomplete. ## Prerequisites - Zone and conduit map with Purdue levels. - On-call contacts: operations manager, safety engineer, controls engineer, IT SOC. - Current detection alerts from `modbus-anomaly-detection`, `dnp3-anomaly-detection`, or the SIEM. - Remote read access to the boundary firewall and the historian. - Credentials: read-only telemetry access. No engineering access is required for triage. - Authorization: operations manager owns every decision that touches a running process. - Upstream skills: `passive-ot-network-discovery` output as the asset baseline. ### Safety This skill is passive by default. Triage collects telemetry and makes decisions. Active containment steps belong to the downstream skills and carry their own gates. - Passive. Reads telemetry and writes the triage report. Safe to run during normal operations. ## Workflow > SAFETY: If at any point the action risks human safety or process integrity, halt and escalate to the operations lead before continuing. 1. Confirm the decision authority. The operations manager decides isolate or monitor. Record the name, contact, and the time of confirmation in the report. 2. Collect the initial facts in five minutes: