| name | incident-triage |
| description | Triage incoming security or operations alerts into severity, impact scope, likely cause buckets, and immediate next checks. |
| license | Apache-2.0 |
| compatibility | Crush SecOps alerting and observability toolchain. |
Incident Triage
When to use this skill
Use on first alert reception to perform consistent, fast triage.
Required tool usage
alert_checkmonitoring_querylog_analyzenetwork_diagnostic (if network symptoms are present)
Workflow
- Normalize input alert: service, env, timestamp, trigger source.
- Assign provisional severity (P1-P4) by impact and urgency.
- Estimate blast radius: single node/service/region/global.
- Run first-check queries and identify most likely cause buckets.
- Output next-step checklist and escalation requirement.
Output contract
- Severity + confidence.
- Impact scope + affected user estimate.
- Top 3 hypotheses with supporting evidence.
- Immediate actions for next 15 minutes.
Red lines
- No offensive security actions.
- No production mutations during triage phase.
- If evidence conflicts, mark as inconclusive and escalate.
