---
title: ToolRouter — Workflow
description: A multi-tool workflow showing how to combine ToolRouter tools for a complex task.
url: https://toolrouter.com/workflows/incident-response-toolkit
---
# Incident Response Toolkit

Investigate security incidents by verifying DNS integrity, scanning for compromise indicators, and researching threat intelligence.

When a security incident occurs, rapid investigation and containment are critical. Security teams need to quickly determine the scope of compromise, identify the exploited vulnerability, and gather threat intelligence to understand the attacker and prevent reoccurrence. Every minute of delay increases potential damage.

This workflow provides a structured incident response approach: verify DNS integrity to detect hijacking, scan for active exploitation and indicators of compromise, identify the likely exploited vulnerability through CVE analysis, and gather threat intelligence from security research communities. It accelerates the investigation phase so teams can move to containment and remediation faster.

**Tools:** security-nuclei, vulnerability-database, web-search, dns-domain
**Category:** security

## Steps

### 1. Verify DNS Integrity

Check DNS records for unauthorized changes, rogue entries, or signs of DNS hijacking that may indicate compromise.

- **Tool:** dns-domain
- **Skill:** lookup_dns
- **Input:** Domain to verify DNS integrity for during incident investigation.
- **Output:** Current DNS records for comparison against known-good baselines.

### 2. Scan for Active Exploitation

Run detection templates to identify active exploitation, webshells, backdoors, and indicators of compromise.

- **Tool:** security-nuclei
- **Skill:** scan_targets
- **Input:** Affected hosts and IOC-focused template categories.
- **Output:** Detected indicators of compromise, backdoors, and active exploitation evidence.

### 3. Identify Exploited Vulnerability

Search for the vulnerability likely exploited in the incident based on observed indicators and affected software.

- **Tool:** vulnerability-database
- **Skill:** search_vulnerabilities
- **Input:** Software versions and observed indicators from the compromised systems.
- **Output:** Candidate CVEs with exploit details, attack vectors, and known exploit code references.

### 4. Research Threat Intelligence

Search for threat intelligence reports, IOC feeds, and community analysis related to the observed attack patterns.

- **Tool:** web-search
- **Skill:** search
- **Input:** IOCs, CVE IDs, and attack patterns observed during the incident.
- **Output:** Threat intelligence reports, attribution analysis, and community-shared IOCs.

## Benefits

- Rapid DNS integrity verification detects hijacking and unauthorized changes
- Automated IOC scanning finds backdoors and webshells quickly
- CVE identification helps understand the attack vector and scope
- Threat intelligence research provides attacker context and additional IOCs
