Incident Response

作者 anthropicsae1513ea94dc无许可证27K 个星标收录于 2026年10月8日更新于 2026年10月8日仓库今天更新

Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.

精选仅含说明DevOps & Cloud Communication

AI 生成的概览

指导事故响应流程：严重级别判定、状态更新、缓解跟踪以及无责事后复盘。

功能: 该技能引导智能体按四个阶段管理事故：分级、沟通、缓解和事后复盘。它提供严重级别判定标准（SEV1-4）、沟通指引，以及状态更新和无责事后复盘文档的 Markdown 模板，包含时间线、5 Whys 根因分析和带责任人的行动项。它还说明了可选的监控、事故管理和聊天工具连接器集成。
适用场景: 适用于事故已宣布的场景，例如生产环境宕机或需要评估严重级别的告警，或需要发布事故中的状态更新时。也用于在问题解决后撰写无责事后复盘。
运行要求: 不附带脚本，仅为说明文档。文中提及可选的监控、事故管理（如 PagerDuty/Opsgenie）和聊天连接器，但并非必需。

/incident-response

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Manage an incident from detection through postmortem.

Usage

Modes

/incident-response new [description]     # Start a new incident/incident-response update [status]       # Post a status update/incident-response postmortem            # Generate postmortem from incident data

/incident-response new [description]     # Start a new incident/incident-response update [status]       # Post a status update/incident-response postmortem            # Generate postmortem from incident data

If no mode is specified, ask what phase the incident is in.

How It Works

┌─────────────────────────────────────────────────────────────────┐│                    INCIDENT RESPONSE                               │├─────────────────────────────────────────────────────────────────┤│  Phase 1: TRIAGE                                                  ││  ✓ Assess severity (SEV1-4)                                     ││  ✓ Identify affected systems and users                          ││  ✓ Assign roles (IC, comms, responders)                         ││                                                                    ││  Phase 2: COMMUNICATE                                              ││  ✓ Draft internal status update                                  ││  ✓ Draft customer communication (if needed)                     ││  ✓ Set up war room and cadence                                   ││                                                                    ││  Phase 3: MITIGATE                                                 ││  ✓ Document mitigation steps taken                               ││  ✓ Track timeline of events                                      ││  ✓ Confirm resolution                                            ││                                                                    ││  Phase 4: POSTMORTEM                                               ││  ✓ Blameless postmortem document                                 ││  ✓ Timeline reconstruction                                       ││  ✓ Root cause analysis (5 whys)                                  ││  ✓ Action items with owners                                      │└─────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐│                    INCIDENT RESPONSE                               │├─────────────────────────────────────────────────────────────────┤│  Phase 1: TRIAGE                                                  ││  ✓ Assess severity (SEV1-4)                                     ││  ✓ Identify affected systems and users                          ││  ✓ Assign roles (IC, comms, responders)                         ││                                                                    ││  Phase 2: COMMUNICATE                                              ││  ✓ Draft internal status update                                  ││  ✓ Draft customer communication (if needed)                     ││  ✓ Set up war room and cadence                                   ││                                                                    ││  Phase 3: MITIGATE                                                 ││  ✓ Document mitigation steps taken                               ││  ✓ Track timeline of events                                      ││  ✓ Confirm resolution                                            ││                                                                    ││  Phase 4: POSTMORTEM                                               ││  ✓ Blameless postmortem document                                 ││  ✓ Timeline reconstruction                                       ││  ✓ Root cause analysis (5 whys)                                  ││  ✓ Action items with owners                                      │└─────────────────────────────────────────────────────────────────┘

Severity Classification

Level	Criteria	Response Time
SEV1	Service down, all users affected	Immediate, all-hands
SEV2	Major feature degraded, many users affected	Within 15 min
SEV3	Minor feature issue, some users affected	Within 1 hour
SEV4	Cosmetic or low-impact issue	Next business day

Communication Guidance

Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.

Output — Status Update

markdown

## Incident Update: [Title]**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved**Impact:** [Who/what is affected]**Last Updated:** [Timestamp]
### Current Status[What we know now]
### Actions Taken- [Action 1]- [Action 2]
### Next Steps- [What's happening next and ETA]
### Timeline| Time | Event ||------|-------|| [HH:MM] | [Event] |

## Incident Update: [Title]**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved**Impact:** [Who/what is affected]**Last Updated:** [Timestamp]
### Current Status[What we know now]
### Actions Taken- [Action 1]- [Action 2]
### Next Steps- [What's happening next and ETA]
### Timeline| Time | Event ||------|-------|| [HH:MM] | [Event] |

Output — Postmortem

markdown

## Postmortem: [Incident Title]**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]**Authors:** [Names] | **Status:** Draft
### Summary[2-3 sentence plain-language summary]
### Impact- [Users affected]- [Duration of impact]- [Business impact if quantifiable]
### Timeline| Time (UTC) | Event ||------------|-------|| [HH:MM] | [Event] |
### Root Cause[Detailed explanation of what caused the incident]
### 5 Whys1. Why did [symptom]? → [Because...]2. Why did [cause 1]? → [Because...]3. Why did [cause 2]? → [Because...]4. Why did [cause 3]? → [Because...]5. Why did [cause 4]? → [Root cause]
### What Went Well- [Things that worked]
### What Went Poorly- [Things that didn't work]
### Action Items| Action | Owner | Priority | Due Date ||--------|-------|----------|----------|| [Action] | [Person] | P0/P1/P2 | [Date] |
### Lessons Learned[Key takeaways for the team]

## Postmortem: [Incident Title]**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]**Authors:** [Names] | **Status:** Draft
### Summary[2-3 sentence plain-language summary]
### Impact- [Users affected]- [Duration of impact]- [Business impact if quantifiable]
### Timeline| Time (UTC) | Event ||------------|-------|| [HH:MM] | [Event] |
### Root Cause[Detailed explanation of what caused the incident]
### 5 Whys1. Why did [symptom]? → [Because...]2. Why did [cause 1]? → [Because...]3. Why did [cause 2]? → [Because...]4. Why did [cause 3]? → [Because...]5. Why did [cause 4]? → [Root cause]
### What Went Well- [Things that worked]
### What Went Poorly- [Things that didn't work]
### Action Items| Action | Owner | Priority | Due Date ||--------|-------|----------|----------|| [Action] | [Person] | P0/P1/P2 | [Date] |
### Lessons Learned[Key takeaways for the team]

If Connectors Available

If ~~monitoring is connected:

Pull alert details and metrics
Show graphs of affected metrics

If ~~incident management is connected:

Create or update incident in PagerDuty/Opsgenie
Page on-call responders

If ~~chat is connected:

Post status updates to incident channel
Create war room channel

Tips

Start writing immediately — Don't wait for complete information. Update as you learn more.
Keep updates factual — What we know, what we've done, what's next. No speculation.
Postmortems are blameless — Focus on systems and processes, not individuals.

来源与署名

来源：anthropics/knowledge-work-plugins位于engineering/skills/incident-response提交ae1513e

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

更多来自 anthropics/knowledge-work-plugins 的技能

Ticket Deflector

anthropics

精选

Reads a forwarded customer email or ticket, pulls order and refund status from a payments connector (PayPal, Square, or Stripe) or Shopify, account history from the CRM, and open tickets from a support desk (Zoho Desk), drafts a tone-matched reply in the owner's writing voice, and can issue a refund through the payments connector with explicit owner approval. With Shopify connected it also runs a proactive order-triage mode that surfaces orders needing attention — unfulfilled past the promised window, payment problems, pending refunds, stuck shipments — and drafts the next action for each before the customer has to ask. Use when the user says "draft a response," "answer this customer," "where's my order," "I want a refund," "check my orders," or "anything about to blow up."

待分类27K今天更新

Tax Season Organizer

anthropics

精选

Prepares tax-season materials for the owner's accountant, not tax advice. US federal tax; a non-US business gets its closed-books packet instead. Two modes: (1) quarterly estimated tax from YTD net income in the ledger (MYOB, NetSuite, QuickBooks, Xero, or Zoho Books); (2) year-end 1099 prep, scanning the ledger, PayPal, and Stripe for contractors paid over USD 600 into a 1099-NEC list with missing W-9 flags. Any tax request routes first to /tax-prep, which confirms the books are closed and reconciled before running this skill. Use this skill directly only when the owner says the period's books are already closed: "books are closed, now do the 1099s," "run the quarterly estimate off the closed numbers," or "just the contractor W-9 list."

待分类27K今天更新

Tax Prep

anthropics

精选

基于已结账的账目准备税务材料：季度预估缴税明细，或年终 1099-NEC 清单与会计师资料包。

Business & Finance27K今天更新

Smb Onboard

anthropics

精选

引导小微企业主完成首次设置：连接工具、运行一次体现价值的配方、记录业务背景并设定每周检查节奏。

Productivity & Workflow27K今天更新

Smb Router

anthropics

精选

将小企业主的需求转接到合适的插件技能或命令，并说明可用功能。

Productivity & Workflow27K今天更新

Month End Prep

anthropics

精选

Reconciles the accounting ledger (MYOB, NetSuite, QuickBooks, Xero, or Zoho Books) against PayPal, Shopify, Square, and Stripe settlements, flags transactions that need attention, suspicious duplicates, and missing receipts, then writes a plain-English P&L narrative and exports a close packet (xlsx + one-page PDF). This is the first link of the /close-month command; a request to close the month or the books routes there, and the command runs this skill before refreshing the forecast and distributing the packet. Use this skill directly only when the owner wants the reconciliation alone, with no forecast refresh and no distribution: "just reconcile, no packet," "what's missing from the books," "flag the duplicates and missing receipts," or "write the P&L narrative for this month."

待分类27K今天更新

Incident Response

/incident-response

Usage

Modes

How It Works

Severity Classification

Communication Guidance

Output — Status Update

Output — Postmortem

If Connectors Available

Tips

来源与署名

更多来自 anthropics/knowledge-work-plugins 的技能

Ticket Deflector

Tax Season Organizer

Tax Prep

Smb Onboard

Smb Router

Month End Prep

更多DevOps & Cloud技能

M5 Onboard

Runbook

Deploy Checklist

Spanner Basics

Secops Cases

Managed Airflow Migrations