ai incident response

A Bash-first, Linux-native AI incident response playbook for the critical first 15 minutes: prepare baselines and audit rules for models/configs; detect anomalies via auditd, journald, lsof/ss and GPU CLIs; rapidly contain with nftables and podman; collect forensics and verify hashes; restore from pinned artifacts; plus a one-command triage script and drills covering prompt-injection, poisoned models, and GPU cryptomining.

A Bash-first, Linux-native incident response playbook for AI systems: install a minimal IR toolbox, baseline and hash model artifacts, audit critical paths, triage logs/GPU/egress, isolate fast with systemd/containers/nftables, verify with YARA/ClamAV/signatures, and rebuild/rotate/harden; includes ready-to-run commands and scenarios for GPU cryptomining, prompt-injection abuse, and model tampering.

Practical, Bash-first guide to AI-assisted incident response on Linux: collect a reproducible triage bundle, summarize and prioritize findings locally with Ollama (no data off-host), harden detection via auditd, and sweep for IOCs with ClamAV and YARA. Includes apt/dnf/zypper installs, redaction, JSON-ready AI prompts, and a real-world example to drive rapid, privacy-preserving, triage-driven decisions.