Menu
Events - pattern anomalies, monitor alert triggers and Kubernetes events.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
AI Teammate - manage connectors (PagerDuty, Slack, GitHub, ...), update teammates (agents) and view teammate activity.
Pipelines - fleet management, config changes, version history, deployments and live capture.
Dashboards - create, update, inspect and validate metric dashboards from the CLI.
Cross-signal incident investigation workflow - from alert to root cause using events, patterns, logs, metrics, traces and pipeline history.
Metrics - discover metric names and run aggregation queries (timeseries and tables).
Monitors - create, manage, snooze and resolve Edge Delta monitors and alerts.
| name | ed-events |
| description | Events - pattern anomalies, monitor alert triggers and Kubernetes events. |
| metadata | {"version":"1.0.0","author":"edgedelta","repository":"https://github.com/edgedelta/agent-skills","tags":"edgedelta,events,anomalies,alerts,kubernetes","alwaysApply":"false"} |
Events are the "what happened" stream: anomaly detections, monitor alert triggers and Kubernetes events. Always check events early in an incident - they often point straight at the cause.
The edx CLI must be installed and authenticated. See the ed-edx skill.
| Query | Meaning |
|---|---|
event.type:"pattern_anomaly" | Log anomaly detections |
event.type:"metric_threshold" | Metric alert triggers |
event.type:"log_threshold" | Log alert triggers |
event.domain:"Monitor" | All monitor-triggered events |
event.domain:"K8s" | Kubernetes events (OOMKilled, BackOff, ...) |
Discover the live set: edx facets options --scope event --facet event.type
and --facet event.domain.
# All anomalies in the last 6 hours
edx events search -q 'event.type:"pattern_anomaly"' --lookback 6h
# Anomalies for one service
edx events search -q 'service.name:"api" AND event.type:"pattern_anomaly"'
# Everything monitors fired recently, as a table
edx events search -q 'event.domain:"Monitor"' --output table
# Kubernetes trouble
edx events search -q 'event.domain:"K8s" AND OOMKilled' --lookback 24h
Full-text search is supported in the event scope (bare words work).
edx events search --from <start> --to <end> - what fired in the window?edx patterns list / edx logs search for detail.edx monitors get <id> for the
query and thresholds behind it.