Comprehensive incident response framework from detection through resolution and post-incident review. Battle-tested SRE/DevOps practices: severity classification, timeline reconstruction, structured post-incident analysis. Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service.
Comprehensive incident response framework from detection through resolution and post-incident review. Battle-tested SRE/DevOps practices: severity classification, timeline reconstruction, structured post-incident analysis. Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service.
Incident Commander Skill
Category: Engineering Team Tier: POWERFUL Author: Claude Skills Team Version: 1.0.0 Last Updated: February 2026
Overview
Incident response framework for availability/reliability incidents (outages, degradations, failed deploys): severity classification, timeline reconstruction, and post-incident review.
This is NOT security incident triage. For security events (ransomware, intrusion, data exfiltration, IOC analysis, NIST SP 800-61 forensics), route to incident-response. Both skills use SEV1-SEV4 labels; this one scores operational impact (users, revenue, SLA), while incident-response classifies attack types and forensic handling.
Key Features
Automated Severity Classification - Intelligent incident triage based on impact and urgency metrics
Timeline Reconstruction - Transform scattered logs and events into coherent incident narratives
Post-Incident Review Generation - Structured PIRs with multiple RCA frameworks
Communication Templates - Pre-built templates for stakeholder updates and escalations
Runbook Integration - Generate actionable runbooks from incident patterns
Skills Included
Core Tools
Incident Classifier (incident_classifier.py)
Analyzes incident descriptions and outputs severity levels
Recommends response teams and initial actions
Generates communication templates based on severity
Subject: URGENT - Customer-Impacting Outage - {Service Name}
Executive Summary:
{2-3 sentence description of customer impact and business implications}
Key Metrics:
- Time to Detection: {X minutes}
- Time to Engagement: {X minutes}
- Estimated Customer Impact: {number/percentage}
- Current Status: {status}
- ETA to Resolution: {time or "investigating"}
Leadership Actions Required:
- [ ] Customer communication approval
- [ ] PR/Communications coordination
- [ ] Resource allocation decisions
- [ ] External vendor engagement
Incident Commander: {name} ({contact})
Next Update: {time}
---
This is an automated alert from our incident response system.
Customer Communication Template
We are currently experiencing {brief description of issue} affecting {scope of impact}.
Our engineering team was alerted at {time} and is actively working to resolve the issue. We will provide updates every {frequency} until resolved.
What we know:
- {factual statement of impact}
- {factual statement of scope}
- {brief status of response}
What we're doing:
- {primary response action}
- {secondary response action}
Workaround (if available):
{workaround steps or "No workaround currently available"}
We apologize for the inconvenience and will share more information as it becomes available.
Next update: {time}
Status page: {link}
Stakeholder Management
Stakeholder Classification
Internal Stakeholders:
Engineering Leadership - Technical decisions and resource allocation
Product Management - Customer impact assessment and feature implications
Customer Support - User communication and support ticket management
Sales/Account Management - Customer relationship management for enterprise clients
Executive Team - Business impact decisions and external communication approval
Legal/Compliance - Regulatory reporting and liability assessment
External Stakeholders:
Customers - Service availability and impact communication
Partners - API availability and integration impacts
Vendors - Third-party service dependencies and support escalation
Regulators - Compliance reporting for regulated industries
Public/Media - Transparency for public-facing outages
Communication Cadence by Stakeholder
Stakeholder
SEV1
SEV2
SEV3
SEV4
Engineering Leadership
Real-time
30min
4hrs
Daily
Executive Team
15min
1hr
EOD
Weekly
Customer Support
Real-time
30min
2hrs
As needed
Customers
15min
1hr
Optional
None
Partners
30min
2hrs
Optional
None
Runbook Generation Framework
Dynamic Runbook Components
Detection Playbooks
Monitoring alert definitions
Triage decision trees
Escalation trigger points
Initial response actions
Response Playbooks
Step-by-step mitigation procedures
Rollback instructions
Validation checkpoints
Communication checkpoints
Recovery Playbooks
Service restoration procedures
Data consistency checks
Performance validation
User notification processes
Runbook Template Structure
# {Service/Component} Incident Response Runbook## Quick Reference-**Severity Indicators:** {list of conditions for each severity level}
-**Key Contacts:** {on-call rotations and escalation paths}
-**Critical Commands:** {list of emergency commands with descriptions}
## Detection### Monitoring Alerts- {Alert name}: {description and thresholds}
- {Alert name}: {description and thresholds}
### Manual Detection Signs- {Symptom}: {what to look for and where}
- {Symptom}: {what to look for and where}
## Initial Response (0-15 minutes)1.**Assess Severity** - [ ] Check {primary metric}
- [ ] Verify {secondary indicator}
- [ ] Classify as SEV{level} based on {criteria}
2.**Establish Command** - [ ] Page Incident Commander if SEV1/2
- [ ] Create incident tracking ticket
- [ ] Join war room: {link/bridge info}
3.**Initial Investigation** - [ ] Check recent deployments: {deployment log location}
- [ ] Review error logs: {log location and queries}
- [ ] Verify dependencies: {dependency check commands}
## Mitigation Strategies### Strategy 1: {Name}**Use when:** {conditions}
**Steps:**1. {detailed step with commands}
2. {detailed step with expected outcomes}
3. {validation step}
**Rollback Plan:**1. {rollback step}
2. {verification step}
### Strategy 2: {Name}
{similar structure}
## Recovery and Validation1.**Service Restoration** - [ ] {restoration step}
- [ ] Wait for {metric} to return to normal
- [ ] Validate end-to-end functionality
2.**Communication** - [ ] Update status page
- [ ] Notify stakeholders
- [ ] Schedule PIR
## Common Pitfalls-**{Pitfall}:** {description and how to avoid}
-**{Pitfall}:** {description and how to avoid}
## Reference Information
→ See references/reference-information.md for details
## Usage Examples### Example 1: Database Connection Pool Exhaustion```bash
# Classify the incident
echo '{"description": "Users reporting 500 errors, database connections timing out", "affected_users": "80%", "business_impact": "high"}' | python scripts/incident_classifier.py
# Reconstruct timeline from logs
python scripts/timeline_reconstructor.py --input assets/sample_timeline_events.json --output timeline.md
# Generate PIR after resolution
python scripts/pir_generator.py --incident assets/sample_incident_data.json --timeline timeline.md --output pir.md
Example 2: API Rate Limiting Incident
# Quick classification from stdinecho"API rate limits causing customer API calls to fail" | python scripts/incident_classifier.py --format text
# Build timeline from multiple sources
python scripts/timeline_reconstructor.py --input assets/simple_timeline_events.json --detect-phases --gap-analysis
# Generate comprehensive PIR
python scripts/pir_generator.py --incident assets/sample_incident_pir_data.json --rca-method fishbone --action-items
Best Practices
During Incident Response
Maintain Calm Leadership
Stay composed under pressure
Make decisive calls with incomplete information
Communicate confidence while acknowledging uncertainty
Document Everything
All actions taken and their outcomes
Decision rationale, especially for controversial calls
Timeline of events as they happen
Effective Communication
Use clear, jargon-free language
Provide regular updates even when there's no new information
Manage stakeholder expectations proactively
Technical Excellence
Prefer rollbacks to risky fixes under pressure
Validate fixes before declaring resolution
Plan for secondary failures and cascading effects
Post-Incident
Blameless Culture
Focus on system failures, not individual mistakes
Encourage honest reporting of what went wrong
Celebrate learning and improvement opportunities
Action Item Discipline
Assign specific owners and due dates
Track progress publicly
Prioritize based on risk and effort
Knowledge Sharing
Share PIRs broadly within the organization
Update runbooks based on lessons learned
Conduct training sessions for common failure modes
