메뉴
Use when handling production incidents, conducting post-mortems, or designing incident response processes. Covers severity classification, incident commander role, communication protocols, root cause analysis, and post-mortem templates.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | incident-management |
| description | Use when handling production incidents, conducting post-mortems, or designing incident response processes. Covers severity classification, incident commander role, communication protocols, root cause analysis, and post-mortem templates. |
| user-invocable | false |
| allowed-tools | ["Read","Write","Bash","Grep","Glob"] |
| Sev | Definition | Response | Examples |
|---|---|---|---|
| SEV1 | Complete outage, data loss, security breach | < 5 min, page IC + lead + VP | Service down, DB corruption, active breach |
| SEV2 | Major feature degraded, partial outage | < 15 min, page IC + lead | Payment failing, login broken for subset |
| SEV3 | Minor degradation, workaround exists | < 1 hr, notify via chat | Slow reports, non-critical errors for one tenant |
| SEV4 | Cosmetic, no user impact | < 4 hr, ticket | Dashboard glitch, dev env instability |
Auto-escalate if not acknowledged within response time.
Authority: Roll back any deploy, page any engineer, escalate/downgrade severity, approve emergency changes, halt non-essential deploys during SEV1.
Duties: Own incident start-to-finish, coordinate responders, control communication cadence (SEV1: every 15min, SEV2: every 30min), declare resolution, schedule post-mortem.
#inc-YYYYMMDD-desc channel, update status page.curl -s https://app.example.com/api/health | jq . # app health
docker compose ps && docker stats --no-stream # container status
df -h && free -h # disk/memory
git log --oneline -5 --format="%h %ai %s" # recent deploys
docker compose logs --since 30m app 2>&1 | grep -ci "error\|exception\|fatal" # error count
docker compose exec -T db psql -U postgres -c "SELECT pid, now()-query_start AS duration, query FROM pg_stat_activity WHERE state != 'idle' ORDER BY duration DESC LIMIT 5;"
Check: error rate vs baseline, p95/p99 latency, traffic anomalies, CPU/memory/disk saturation, queue depth.
| Strategy | Speed | Risk | When |
|---|---|---|---|
| Feature flag disable | Seconds | Very low | Bad feature rollout |
| Rollback deployment | 2-5 min | Low | Correlated with recent deploy |
| Traffic shifting | 1-2 min | Low | Canary/blue-green |
| Scale up/out | 3-10 min | Low | Capacity issue |
| Restart service | 1-2 min | Medium | Memory leak, hung process |
| Failover to secondary | 5-15 min | Medium | Primary infra failure |
| Hotfix deploy | 15-30 min | Higher | Rollback not possible |
[INVESTIGATING] Investigating <symptom>. Impact: <user-facing>. Started: <UTC>. Next update: <time>.
[IDENTIFIED] Root cause: <brief>. Working on fix. Next update: <time>.
[MONITORING] Fix applied. Monitoring stability. Next update: <time>.
[RESOLVED] Resolved. Duration: <X>h <Y>m. Root cause: <summary>. Post-mortem within 48hr.
Problem: Users got 500 errors on invoice endpoint.
Why 1: Out-of-memory exception.
Why 2: Query loaded all line items into memory.
Why 3: No pagination, eager-loaded nested relations.
Why 4: Code review missed unbounded query.
Why 5: No static analysis rule for query size.
Root cause: Missing guardrails for query result size.
When 5 Whys diverge, use Fishbone categories: People, Process, Technology, Environment, Monitoring.
# Post-Mortem: <Title>
**Date/Severity/Duration/IC/Author**
## Summary: 2-3 sentences on what happened and user impact.
## Impact: Users affected, revenue impact, data impact, duration.
## Timeline (UTC): Alert -> Declared -> Identified -> Mitigated -> Resolved.
## Root Cause: Technical explanation + 5 Whys.
## Detection: How detected, time to detection, improvement opportunities.
## Response: What went well, what could improve.
## Action Items
| Priority | Action | Owner | Due | Status |
|----------|--------|-------|-----|--------|
| P0 | Prevent recurrence | name | date | Open |
| P1 | Improve detection | name | date | Open |
## Lessons Learned
| Metric | Target |
|---|---|
| MTTD (detect) | < 5 min |
| MTTA (acknowledge) | < 5 min SEV1, < 15 min SEV2 |
| MTTR (resolve) | < 1 hr SEV1, < 4 hr SEV2 |
| MTBF | Increasing trend |
Track action item completion: target 90% within 30 days.
Focus on systems not people. Assume good intent. Discuss "the deploy" not "your deploy." Learning over punishment. Use language like "How can we improve detection?" not "Why didn't you catch this?"
Use when managing Laravel Forge servers, sites, deployments, SSL, databases, queue workers, scheduled jobs, security rules, and server provisioning. Covers Forge CLI, API, deployment scripts, Nginx templates, daemon management, and zero-downtime deployments.
Project-specific Ansible operations template — customize with your inventory, playbook catalog, deployment workflows, and host group details
Use when implementing or auditing accessibility features. Covers WCAG 2.1 AA/AAA compliance, ARIA roles and attributes, keyboard navigation, screen reader support, color contrast, focus management, and accessible component patterns.
Use when evaluating AI/LLM systems — benchmark design, automated evaluation pipelines, human evaluation protocols, A/B testing, hallucination detection, factuality checking, bias testing, safety evaluation (red teaming), latency/cost metrics, eval datasets, regression testing for prompts, and model comparison frameworks.
Use when building KPI frameworks, designing dashboards, analyzing marketing performance, setting up attribution models, or creating automated reports. Covers Google Analytics 4, social media analytics, funnel analysis, cohort analysis, A/B test analysis, ROI calculation, competitive benchmarking, and stakeholder reporting.
Use when designing or implementing REST APIs. Covers RESTful conventions, versioning, pagination, filtering, error handling, rate limiting, HATEOAS, OpenAPI documentation, and API security best practices.