| name | playbook-lookup |
| description | Query past incident resolutions from the knowledge base. Use when asked about prior incidents, what fixed a host/alert before, or playbooks for similar alerts. Searches by hostname or alert rule name. |
| allowed-tools | Bash |
| user-invocable | true |
| metadata | {"openclaw":{"always":true}} |
Incident Playbook Lookup
Queries the incident knowledge base for past resolutions. Use this skill when:
- "what fixed CPU high on nl-pve01?"
- "past incidents for CiliumAgentNotReady"
- "playbook for disk space alerts"
- "what was the resolution for IFRNLLEI01PRD-109?"
- "has this alert happened before?"
- Any question about prior incident resolutions or playbooks
HOW to use
Run the lookup script with a search term (hostname, alert rule name, or issue ID):
./skills/playbook-lookup/playbook-lookup.sh nl-pve01
./skills/playbook-lookup/playbook-lookup.sh CiliumAgentNotReady
./skills/playbook-lookup/playbook-lookup.sh IFRNLLEI01PRD-109
The script queries the incident_knowledge SQLite table on app-user and returns matching past resolutions with:
- Issue ID and date
- Hostname and alert rule
- Resolution summary
- Confidence score
CRITICAL RULES
- RUN THE TOOL FIRST. Do not answer from memory about past incidents.
- Present the results clearly. Include the issue ID, date, and confidence.
- Note if no results found. The knowledge base only contains resolved infra sessions.
