ransomware-remediation
Investigate ransomware, malware, and data-anomaly findings on Eon-protected resources, and build a remediation playbook to restore affected resources to their last verified-clean recovery point. Covers counting and listing infected resources, reading security-scan evidence and anomaly graphs, resolving a clean snapshot and restore template per resource, and executing a human-confirmed bulk restore including the multi-party-approval handoff. Use whenever the user asks about ransomware/malware/data-anomaly detections, infected resources, or wants to clean up, remediate, or recover from a security incident.
Install
With your agent
Install OMGSkills skill "eon-io/claude-code-eon-plugin:skills/ransomware-remediation" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/eon-io/claude-code-eon-plugin /tmp/claude-code-eon-plugin && ln -s /tmp/claude-code-eon-plugin/skills/ransomware-remediation ~/.claude/skills/ransomware-remediationFrom README
Ransomware Investigation & Remediation Eon's security scanner examines every backup snapshot with three detectors (ransomware behavior, malware, data anomaly) and assigns each resource a scan conclusion. There is no named-strain concept; you work from conclusions and their evidence. Part A — Investigate produces a per-resource incident report. Part B — Remediate restores affected resources to their latest clean snapshot. The user may enter at either part, but always show which resources will be touched before restoring anything. Wire shapes, filter JSON, enum values, status codes, and the enum-to-plain-language translation table live in references/api-details.md. Load it before constructing any call or presenting results. Part A — Investigate A1 — Scope the incident Resolve the project via listprojects (never ask the user for IDs you can look up). countinfectedresources for the headline count (excludes muted).
More from this repo
aws-onboarding
Guide users through connecting their AWS source accounts to the Eon platform.
backup-policy-creation
Guide users through creating a backup policy in Eon: choosing the policy type, defining the resource selector,...
cost-explorer-query
Answer Eon customer questions about cloud-resource consumption — how many GB/month or USD/credits an account, project,...