菜单
List and filter alerts in Resolve. Use when the user asks "show me alerts", "any new alerts", "alerts on <team>", "find the alert matching <pattern>", "alerts that auto-investigated", "alerts where <label> is critical/missing", or wants a focused alerts view (separate from a full overview snapshot).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | alerts |
| description | List and filter alerts in Resolve. Use when the user asks "show me alerts", "any new alerts", "alerts on <team>", "find the alert matching <pattern>", "alerts that auto-investigated", "alerts where <label> is critical/missing", or wants a focused alerts view (separate from a full overview snapshot). |
| version | 0.1.0 |
| argument-hint | <optional filter description> |
| license | Apache-2.0 |
Use for focused alert listings and alert drill-downs.
If $ARGUMENTS is non-empty, translate it into list_alerts filters.
If $ARGUMENTS is empty, call list_alerts with the tool defaults. Only ask the user to narrow if the result set is overwhelming.
Map common phrasings to the right filter family:
Examples:
service is missing" → missing-label filter.For unsupported inverse filters, fetch a reasonable recent set and post-filter locally.
Summarize compactly:
time, title, severity, action, is_auto_investigated, entity_key.investigation_id; never fabricate one.[label](path) citations verbatim.If the list is long, group by alert_rule_key or a salient label and offer to narrow further.
resolve-ai:overview.investigation_id directly → resolve-ai:investigate <investigation_id>.resolve-ai:steer.Edit a Resolve satellite's Helm values.yaml — add or modify integrations on the satellite, configure networking, set environment variables. Use when the user mentions editing satellite config — phrases like "edit satellite values.yaml", "add Tempo to my satellite", "configure satellite networking", "satellite chart values", "satellite helm config", or "wire up a satellite integration".
Send Resolve a question or a request to investigate — continuing an existing chat or investigation, or starting a fresh one. Use when the user wants to send a message to Resolve — phrases like "ask Resolve about X", "follow up with Resolve", "what does Resolve think about Y", "have Resolve check Z", or wants Resolve to clarify a finding.
Run a guided, self-paced tour of Resolve using the connected org's live data — surface the environment, resume a chat, fire several in parallel, drill a real RCA with its evidence and a live thread, then investigate something from scratch. Use when someone wants to demo Resolve, give a tour, or show a new user what it can do — phrases like "demo Resolve", "give me a tour", "walk them through Resolve", "show me what Resolve can do", "demo this to <person>".
Write or tune a skill for the Resolve plugin — encoding workflow guidance, not tool API details.
Run a guided, self-paced tour of Resolve using the connected org's live data — surface the environment, resume a chat, fire several in parallel, drill a real RCA with its evidence and a live thread, then investigate something from scratch. Use when someone wants to demo Resolve, give a tour, or show a new user what it can do — phrases like "demo Resolve", "give me a tour", "walk them through Resolve", "show me what Resolve can do", "demo this to <person>".
Run a guided, self-paced tour of Resolve using the connected org's live data — surface the environment, resume a chat, fire several in parallel, drill a real RCA with its evidence and a live thread, then investigate something from scratch. Use when someone wants to demo Resolve, give a tour, or show a new user what it can do — phrases like "demo Resolve", "give me a tour", "walk them through Resolve", "show me what Resolve can do", "demo this to <person>".