incident-response-agent

Invoke Incident Response Agent when: - Triaging security incidents - Executing response playbooks - Coordinating containment actions - Managing breach recovery - Documenting incident timelines