Incident Triage Brief

Skill files

The public post is only the explanation. Use these links to inspect or download the actual reviewed skill artifact.

skill.mdDownload SKILL.mdevalDownload evals.json

Skill Overview

Incident triage gets slower when logs, alerts, deploy notes, metrics, customer reports, and Slack updates stay scattered across tools. The incident-triage-brief Codex skill gives Technical Analysts a repeatable way to turn that evidence into a concise brief that responders can use during escalation, handoff, mitigation review, or post-incident analysis.

The skill is intentionally narrow. It does not try to run a full incident command process, operate production systems, or produce a polished postmortem. It focuses on one repeatable workflow: explaining what is known, what is suspected, how confident the team should be, and what checks would reduce uncertainty fastest.

Intended Role

This skill is designed for Technical Analysts working with SRE, engineering, support, product, or incident-command teams. It is useful when an analyst needs to package operational evidence for a backend owner, data platform owner, mobile team, payments team, support leadership, or on-call lead.

Required Inputs

• Incident evidence such as alert payloads, logs, metrics, traces, deployment notes, feature-flag changes, support tickets, customer reports, status page notes, Slack updates, runbook notes, or database/API error samples.
• Service context such as affected service, environment, region, dependency, release version, owner, SLO/SLA target, severity policy, traffic pattern, or recent operational change when available.
• Timing context such as first alert, first customer report, deploy window, recurrence pattern, mitigation attempts, recovery time, or timezone when available.
• Audience and handoff target, such as SRE, backend team, frontend team, data platform, support leadership, incident commander, executive update, or post-incident review.

The skill can proceed with incomplete information, but it labels evidence gaps rather than filling them with false certainty.

Expected Output

The skill produces:

• Executive summary with service, user impact, current state, likely cause category, confidence, and immediate recommendation.
• Evidence inventory with source, timestamp, signal type, relevant observation, and reliability of each input.
• Timeline from first known signal through current status.
• Impact assessment for affected users, regions, endpoints, workflows, severity, SLO/SLA exposure, support volume, and business risk.
• Symptom-to-evidence matrix that maps symptoms to logs, metrics, traces, deploys, reports, and mitigations.
• Hypotheses with supporting evidence, contradicting or missing evidence, confidence, and next checks.
• Known gaps and ambiguity.
• Recommended next actions with owner, urgency, rationale, and dependency.
• Paste-ready internal handoff note.

Validation Scenario

The included eval set checks three realistic Technical Analyst situations:

• A subscription API incident where 500s and latency follow a coupon-validation deploy, queue depth rises in a dependency, self-serve checkout fails, and rollback only partly recovers the service.
• A stale account-health dashboard where the visible product symptom points to a data freshness failure caused by a warehouse permission change or cached source fallback.
• A mobile push-notification delay where an iOS release, worker saturation, queue backlog, and autoscale mitigation need to be separated from a coincident marketing campaign.

The expected outputs verify that the skill reconstructs timelines, separates symptoms from likely causes, avoids unsupported blame, assesses impact conservatively, labels confidence, and proposes targeted next checks.

Operational Limits

This is a low-risk workflow skill for preparing internal technical analysis. It does not access observability systems by itself, declare incident severity, page responders, execute runbooks, roll back deploys, alter feature flags, modify customer data, or send public/customer-facing updates automatically.

Technical Analysts should review the brief with the appropriate on-call, engineering, SRE, support, security, legal, or communications owner before using it for mitigation decisions, executive updates, status page language, regulatory notifications, or postmortem claims.

Maintenance Expectations

Review this skill when the organization’s severity model, ownership map, incident-command process, SLO language, observability stack, log-retention policy, or escalation workflow changes. Refresh evals when new recurring incident patterns appear, such as AI-agent failures, queue backpressure, data freshness incidents, third-party outages, regional traffic-routing issues, or mobile rollout regressions.

Related Existing Skills

Public incident and root-cause resources exist, but most are broader than this Technical Analyst handoff workflow. The closest adjacent skills focus on full incident response, incident command, postmortems, or 5-Whys root cause analysis. The airoweb skill stays narrower by converting supplied evidence into a triage brief with timeline, impact, hypotheses, confidence, evidence gaps, and next investigation checks.

• 5-Whys Root Cause Analysis Skill: a Claude Code skill for systematic root-cause analysis through 5-Whys. It is useful after the problem is framed; the airoweb skill focuses earlier on triage packaging and evidence quality.
• Incident Response SKILL.md: a broader incident-response skill for detection, triage, mitigation, communication, and resolution. The airoweb skill avoids owning the full response process and instead prepares an analyst brief for the responders.
• Root Cause Analysis: a marketplace listing for structured RCA and incident-report templates. The airoweb artifact is narrower and emphasizes current-state triage, uncertainty, and next checks before final RCA.
• Build an SRE incident response agent with Claude Managed Agents: an Anthropic cookbook for a managed SRE agent that reads tools, investigates, opens a fix PR, and waits for approval. The airoweb skill is tool-agnostic and works from evidence the user provides.
• The site reliability agent: an Anthropic Agent SDK example for autonomous incident investigation and remediation. This is adjacent architecture guidance, while the airoweb skill is an operational writing and analysis workflow.
• AI SRE with Claude Code: 5 On-Call Reliability Workflows: a broader article on incident triage, runbook execution, postmortems, SLO investigation, and on-call handoffs with MCP-backed tools. The airoweb skill covers just the incident-triage brief.
• SRE incident post-mortem best practices: an adjacent incident-management reference for postmortem artifacts and follow-up practice. The airoweb skill is for live or near-live triage rather than retrospective write-up.