Incident Response

作者 anthropicsae1513ea94dc無授權條款27K 個星標收錄於 2026年10月8日更新於 2026年10月8日儲存庫今天更新

Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.

精選僅含說明DevOps & CloudCommunication
AI 產生的概覽

引導事故回應流程：嚴重程度分級、狀態更新、緩解追蹤，以及無責事後檢討。

功能
此技能引導代理依四個階段管理事故：分級、溝通、緩解與事後檢討。它提供嚴重程度判定準則（SEV1-4）、溝通指引，以及狀態更新與無責事後檢討文件的 Markdown 範本，包含時間軸、5 Whys 根因分析和附負責人的行動項目。它也說明可選的監控、事故管理與聊天工具連接器整合。
適用情境
適用於事故已宣告的情況，例如正式環境中斷或需要評估嚴重程度的告警，或需要發布事故期間的狀態更新時。也用於問題解決後撰寫無責事後檢討。
執行需求
不隨附指令碼，僅為指示文件。文中提及可選的監控、事故管理（如 PagerDuty/Opsgenie）與聊天連接器，但並非必要。

/incident-response

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Manage an incident from detection through postmortem.

Usage

/incident-response $ARGUMENTS

Modes

/incident-response new [description]     # Start a new incident/incident-response update [status]       # Post a status update/incident-response postmortem            # Generate postmortem from incident data

If no mode is specified, ask what phase the incident is in.

How It Works

┌─────────────────────────────────────────────────────────────────┐│                    INCIDENT RESPONSE                               │├─────────────────────────────────────────────────────────────────┤│  Phase 1: TRIAGE                                                  ││  ✓ Assess severity (SEV1-4)                                     ││  ✓ Identify affected systems and users                          ││  ✓ Assign roles (IC, comms, responders)                         ││                                                                    ││  Phase 2: COMMUNICATE                                              ││  ✓ Draft internal status update                                  ││  ✓ Draft customer communication (if needed)                     ││  ✓ Set up war room and cadence                                   ││                                                                    ││  Phase 3: MITIGATE                                                 ││  ✓ Document mitigation steps taken                               ││  ✓ Track timeline of events                                      ││  ✓ Confirm resolution                                            ││                                                                    ││  Phase 4: POSTMORTEM                                               ││  ✓ Blameless postmortem document                                 ││  ✓ Timeline reconstruction                                       ││  ✓ Root cause analysis (5 whys)                                  ││  ✓ Action items with owners                                      │└─────────────────────────────────────────────────────────────────┘

Severity Classification

LevelCriteriaResponse Time
SEV1Service down, all users affectedImmediate, all-hands
SEV2Major feature degraded, many users affectedWithin 15 min
SEV3Minor feature issue, some users affectedWithin 1 hour
SEV4Cosmetic or low-impact issueNext business day

Communication Guidance

Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.

Output — Status Update

markdown
## Incident Update: [Title]**Severity:** SEV[1-4] | **Status:** Investigating | Identified | Monitoring | Resolved**Impact:** [Who/what is affected]**Last Updated:** [Timestamp]
### Current Status[What we know now]
### Actions Taken- [Action 1]- [Action 2]
### Next Steps- [What's happening next and ETA]
### Timeline| Time | Event ||------|-------|| [HH:MM] | [Event] |

Output — Postmortem

markdown
## Postmortem: [Incident Title]**Date:** [Date] | **Duration:** [X hours] | **Severity:** SEV[X]**Authors:** [Names] | **Status:** Draft
### Summary[2-3 sentence plain-language summary]
### Impact- [Users affected]- [Duration of impact]- [Business impact if quantifiable]
### Timeline| Time (UTC) | Event ||------------|-------|| [HH:MM] | [Event] |
### Root Cause[Detailed explanation of what caused the incident]
### 5 Whys1. Why did [symptom]? → [Because...]2. Why did [cause 1]? → [Because...]3. Why did [cause 2]? → [Because...]4. Why did [cause 3]? → [Because...]5. Why did [cause 4]? → [Root cause]
### What Went Well- [Things that worked]
### What Went Poorly- [Things that didn't work]
### Action Items| Action | Owner | Priority | Due Date ||--------|-------|----------|----------|| [Action] | [Person] | P0/P1/P2 | [Date] |
### Lessons Learned[Key takeaways for the team]

If Connectors Available

If ~~monitoring is connected:

  • Pull alert details and metrics
  • Show graphs of affected metrics

If ~~incident management is connected:

  • Create or update incident in PagerDuty/Opsgenie
  • Page on-call responders

If ~~chat is connected:

  • Post status updates to incident channel
  • Create war room channel

Tips

  1. Start writing immediately — Don't wait for complete information. Update as you learn more.
  2. Keep updates factual — What we know, what we've done, what's next. No speculation.
  3. Postmortems are blameless — Focus on systems and processes, not individuals.

來源與署名

來源：anthropics/knowledge-work-plugins位於engineering/skills/incident-response提交ae1513e

授權條款： 無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

更多來自 anthropics/knowledge-work-plugins 的技能

Ticket Deflector

anthropics

精選

Reads a forwarded customer email or ticket, pulls order and refund status from a payments connector (PayPal, Square, or Stripe) or Shopify, account history from the CRM, and open tickets from a support desk (Zoho Desk), drafts a tone-matched reply in the owner's writing voice, and can issue a refund through the payments connector with explicit owner approval. With Shopify connected it also runs a proactive order-triage mode that surfaces orders needing attention — unfulfilled past the promised window, payment problems, pending refunds, stuck shipments — and drafts the next action for each before the customer has to ask. Use when the user says "draft a response," "answer this customer," "where's my order," "I want a refund," "check my orders," or "anything about to blow up."

待分類27K今天更新

Tax Season Organizer

anthropics

精選

Prepares tax-season materials for the owner's accountant, not tax advice. US federal tax; a non-US business gets its closed-books packet instead. Two modes: (1) quarterly estimated tax from YTD net income in the ledger (MYOB, NetSuite, QuickBooks, Xero, or Zoho Books); (2) year-end 1099 prep, scanning the ledger, PayPal, and Stripe for contractors paid over USD 600 into a 1099-NEC list with missing W-9 flags. Any tax request routes first to /tax-prep, which confirms the books are closed and reconciled before running this skill. Use this skill directly only when the owner says the period's books are already closed: "books are closed, now do the 1099s," "run the quarterly estimate off the closed numbers," or "just the contractor W-9 list."

待分類27K今天更新

Tax Prep

anthropics

精選

根據已結帳的帳目準備稅務資料：季度預估繳稅明細，或年終 1099-NEC 清單與會計師資料包。

Business & Finance27K今天更新

Smb Onboard

anthropics

精選

引導小型企業主完成首次設定：連接工具、執行一次展現價值的配方、記錄業務背景並設定每週檢查節奏。

Productivity & Workflow27K今天更新

Smb Router

anthropics

精選

將小型企業主的需求轉接到合適的外掛技能或指令，並說明可用功能。

Productivity & Workflow27K今天更新

Month End Prep

anthropics

精選

Reconciles the accounting ledger (MYOB, NetSuite, QuickBooks, Xero, or Zoho Books) against PayPal, Shopify, Square, and Stripe settlements, flags transactions that need attention, suspicious duplicates, and missing receipts, then writes a plain-English P&L narrative and exports a close packet (xlsx + one-page PDF). This is the first link of the /close-month command; a request to close the month or the books routes there, and the command runs this skill before refreshing the forecast and distributing the packet. Use this skill directly only when the owner wants the reconciliation alone, with no forecast refresh and no distribution: "just reconcile, no packet," "what's missing from the books," "flag the duplicates and missing receipts," or "write the P&L narrative for this month."

待分類27K今天更新

更多DevOps & Cloud技能

M5 Onboard

anthropics

精選

透過 USB 偵測 M5Stack ESP32 開發板，燒錄 UIFlow 2.0 韌體並安裝 MicroPython 應用程式套件。

DevOps & Cloud37K今天更新

Runbook

anthropics

精選

為重複性任務建立或更新逐步操作手冊，包含疑難排解、回復與升級流程。

DevOps & Cloud27K今天更新

Deploy Checklist

anthropics

精選

產生部署前就緒檢查清單，涵蓋部署前、部署、部署後與回復觸發條件。

DevOps & Cloud27K今天更新

Spanner Basics

google

精選

指導 Google Cloud Spanner 的執行個體與資料庫管理、結構定義設計、查詢與效能診斷。

DevOps & Cloud21K今天更新

Secops Cases

google

精選

透過 MCP 工具管理 Google Security Operations SOAR 案件的完整生命週期。

DevOps & Cloud21K今天更新

Managed Airflow Migrations

google

精選

指導將 Apache Airflow DAG 移轉至 Managed Service for Apache Airflow 中的 Airflow 2.11.1 或 Airflow 3。

DevOps & Cloud21K今天更新