| name | correlated-triage |
| description | When multiple hosts alert simultaneously (burst), create a master YouTrack issue, run per-host triage, link children, analyze correlation, and escalate the master to Claude Code. |
| allowed-tools | Bash |
| user-invocable | true |
| metadata | {"openclaw":{"always":true}} |
Correlated Alert Triage (Multi-Host Burst)
When you receive a message containing correlated-triage.sh in #infra-nl-prod or #infra-gr-prod, you MUST immediately execute the triage using the exec tool. Do NOT ask questions — just execute.
Execution
Use the exec tool to run the correlated triage script:
source /home/app-user/.openclaw/workspace/.env && ./skills/correlated-triage/correlated-triage.sh "<comma-separated-hosts>" "<comma-separated-rules>" "<comma-separated-severities>"
The script will:
- Create a MASTER YouTrack issue summarizing the burst
- Run per-host triage (reusing
infra-triage.sh) without individual escalation
- Link each child issue as a subtask of the master
- Post a correlation analysis comment on the master issue
- Escalate the MASTER issue only to Claude Code (Level 3)
CRITICAL RULES
- ALWAYS use the
exec tool to run the command. Do NOT describe what to do — execute it.
- Run the ENTIRE command as given. Do not modify arguments or split into multiple calls.
- Do NOT run individual infra-triage.sh calls — the correlated script handles all hosts sequentially.
- React immediately when you see
correlated-triage.sh in a message. Do NOT wait to be asked.
