incident-response

Name: incident-response
Author: anthropics

4.5kinstalls2.7kforks

How to install incident-response?

anthropics/knowledge-work-plugins/incident-response

$npx -y skills add anthropics/knowledge-work-plugins --skill incident-response

Installs into the current project.

Summary

Run an incident response workflow — triage, communicate, and write postmortem. Trigger with "we have an incident", "production is down", an alert that needs severity assessment, a status update mid-incident, or when writing a blameless postmortem after resolution.

Files · 1

View on GitHub

SKILL.md

1	# /incident-response
2
3	> If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](../../CONNECTORS.md).
4
5	Manage an incident from detection through postmortem.
6
7	## Usage
8
9	```
10	/incident-response $ARGUMENTS
11	```
12
13	## Modes
14
15	```
16	/incident-response new [description] # Start a new incident
17	/incident-response update [status] # Post a status update
18	/incident-response postmortem # Generate postmortem from incident data
19	```
20
21	If no mode is specified, ask what phase the incident is in.
22
23	## How It Works
24
25	```
26	┌─────────────────────────────────────────────────────────────────┐
27	│ INCIDENT RESPONSE │
28	├─────────────────────────────────────────────────────────────────┤
29	│ Phase 1: TRIAGE │
30	│ ✓ Assess severity (SEV1-4) │
31	│ ✓ Identify affected systems and users │
32	│ ✓ Assign roles (IC, comms, responders) │
33	│ │
34	│ Phase 2: COMMUNICATE │
35	│ ✓ Draft internal status update │
36	│ ✓ Draft customer communication (if needed) │
37	│ ✓ Set up war room and cadence │
38	│ │
39	│ Phase 3: MITIGATE │
40	│ ✓ Document mitigation steps taken │
41	│ ✓ Track timeline of events │
42	│ ✓ Confirm resolution │
43	│ │
44	│ Phase 4: POSTMORTEM │
45	│ ✓ Blameless postmortem document │
46	│ ✓ Timeline reconstruction │
47	│ ✓ Root cause analysis (5 whys) │
48	│ ✓ Action items with owners │
49	└─────────────────────────────────────────────────────────────────┘
50	```
51
52	## Severity Classification
53
54	\| Level \| Criteria \| Response Time \|
55	\|-------\|----------\|---------------\|
56	\| SEV1 \| Service down, all users affected \| Immediate, all-hands \|
57	\| SEV2 \| Major feature degraded, many users affected \| Within 15 min \|
58	\| SEV3 \| Minor feature issue, some users affected \| Within 1 hour \|
59	\| SEV4 \| Cosmetic or low-impact issue \| Next business day \|
60
61	## Communication Guidance
62
63	Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.
64
65	## Output — Status Update
66
67	```markdown
68	## Incident Update: [Title]
69	Severity: SEV[1-4] \| Status: Investigating \| Identified \| Monitoring \| Resolved
70	Impact: [Who/what is affected]
71	Last Updated: [Timestamp]
72
73	### Current Status
74	[What we know now]
75
76	### Actions Taken
77	- [Action 1]
78	- [Action 2]
79
80	### Next Steps
81	- [What's happening next and ETA]
82
83	### Timeline
84	\| Time \| Event \|
85	\|------\|-------\|
86	\| [HH:MM] \| [Event] \|
87	```
88
89	## Output — Postmortem
90
91	```markdown
92	## Postmortem: [Incident Title]
93	Date: [Date] \| Duration: [X hours] \| Severity: SEV[X]
94	Authors: [Names] \| Status: Draft
95
96	### Summary
97	[2-3 sentence plain-language summary]
98
99	### Impact
100	- [Users affected]
101	- [Duration of impact]
102	- [Business impact if quantifiable]
103
104	### Timeline
105	\| Time (UTC) \| Event \|
106	\|------------\|-------\|
107	\| [HH:MM] \| [Event] \|
108
109	### Root Cause
110	[Detailed explanation of what caused the incident]
111
112	### 5 Whys
113	1. Why did [symptom]? → [Because...]
114	2. Why did [cause 1]? → [Because...]
115	3. Why did [cause 2]? → [Because...]
116	4. Why did [cause 3]? → [Because...]
117	5. Why did [cause 4]? → [Root cause]
118
119	### What Went Well
120	- [Things that worked]
121
122	### What Went Poorly
123	- [Things that didn't work]
124
125	### Action Items
126	\| Action \| Owner \| Priority \| Due Date \|
127	\|--------\|-------\|----------\|----------\|
128	\| [Action] \| [Person] \| P0/P1/P2 \| [Date] \|
129
130	### Lessons Learned
131	[Key takeaways for the team]
132	```
133
134	## If Connectors Available
135
136	If ~~monitoring is connected:
137	- Pull alert details and metrics
138	- Show graphs of affected metrics
139
140	If ~~incident management is connected:
141	- Create or update incident in PagerDuty/Opsgenie
142	- Page on-call responders
143
144	If ~~chat is connected:
145	- Post status updates to incident channel
146	- Create war room channel
147
148	## Tips
149
150	1. Start writing immediately — Don't wait for complete information. Update as you learn more.
151	2. Keep updates factual — What we k

People who liked this also viewed

6 picks

Type

incident-response

4.5kinstalls2.7kforks

View on GitHub

How to install incident-response?

anthropics/knowledge-work-plugins/incident-response

$npx -y skills add anthropics/knowledge-work-plugins --skill incident-response

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# /incident-response
2
3	> If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](../../CONNECTORS.md).
4
5	Manage an incident from detection through postmortem.
6
7	## Usage
8
9	```
10	/incident-response $ARGUMENTS
11	```
12
13	## Modes
14
15	```
16	/incident-response new [description] # Start a new incident
17	/incident-response update [status] # Post a status update
18	/incident-response postmortem # Generate postmortem from incident data
19	```
20
21	If no mode is specified, ask what phase the incident is in.
22
23	## How It Works
24
25	```
26	┌─────────────────────────────────────────────────────────────────┐
27	│ INCIDENT RESPONSE │
28	├─────────────────────────────────────────────────────────────────┤
29	│ Phase 1: TRIAGE │
30	│ ✓ Assess severity (SEV1-4) │
31	│ ✓ Identify affected systems and users │
32	│ ✓ Assign roles (IC, comms, responders) │
33	│ │
34	│ Phase 2: COMMUNICATE │
35	│ ✓ Draft internal status update │
36	│ ✓ Draft customer communication (if needed) │
37	│ ✓ Set up war room and cadence │
38	│ │
39	│ Phase 3: MITIGATE │
40	│ ✓ Document mitigation steps taken │
41	│ ✓ Track timeline of events │
42	│ ✓ Confirm resolution │
43	│ │
44	│ Phase 4: POSTMORTEM │
45	│ ✓ Blameless postmortem document │
46	│ ✓ Timeline reconstruction │
47	│ ✓ Root cause analysis (5 whys) │
48	│ ✓ Action items with owners │
49	└─────────────────────────────────────────────────────────────────┘
50	```
51
52	## Severity Classification
53
54	\| Level \| Criteria \| Response Time \|
55	\|-------\|----------\|---------------\|
56	\| SEV1 \| Service down, all users affected \| Immediate, all-hands \|
57	\| SEV2 \| Major feature degraded, many users affected \| Within 15 min \|
58	\| SEV3 \| Minor feature issue, some users affected \| Within 1 hour \|
59	\| SEV4 \| Cosmetic or low-impact issue \| Next business day \|
60
61	## Communication Guidance
62
63	Provide clear, factual updates at regular cadence. Include: what's happening, who's affected, what we're doing, when the next update is.
64
65	## Output — Status Update
66
67	```markdown
68	## Incident Update: [Title]
69	Severity: SEV[1-4] \| Status: Investigating \| Identified \| Monitoring \| Resolved
70	Impact: [Who/what is affected]
71	Last Updated: [Timestamp]
72
73	### Current Status
74	[What we know now]
75
76	### Actions Taken
77	- [Action 1]
78	- [Action 2]
79
80	### Next Steps
81	- [What's happening next and ETA]
82
83	### Timeline
84	\| Time \| Event \|
85	\|------\|-------\|
86	\| [HH:MM] \| [Event] \|
87	```
88
89	## Output — Postmortem
90
91	```markdown
92	## Postmortem: [Incident Title]
93	Date: [Date] \| Duration: [X hours] \| Severity: SEV[X]
94	Authors: [Names] \| Status: Draft
95
96	### Summary
97	[2-3 sentence plain-language summary]
98
99	### Impact
100	- [Users affected]
101	- [Duration of impact]
102	- [Business impact if quantifiable]
103
104	### Timeline
105	\| Time (UTC) \| Event \|
106	\|------------\|-------\|
107	\| [HH:MM] \| [Event] \|
108
109	### Root Cause
110	[Detailed explanation of what caused the incident]
111
112	### 5 Whys
113	1. Why did [symptom]? → [Because...]
114	2. Why did [cause 1]? → [Because...]
115	3. Why did [cause 2]? → [Because...]
116	4. Why did [cause 3]? → [Because...]
117	5. Why did [cause 4]? → [Root cause]
118
119	### What Went Well
120	- [Things that worked]
121
122	### What Went Poorly
123	- [Things that didn't work]
124
125	### Action Items
126	\| Action \| Owner \| Priority \| Due Date \|
127	\|--------\|-------\|----------\|----------\|
128	\| [Action] \| [Person] \| P0/P1/P2 \| [Date] \|
129
130	### Lessons Learned
131	[Key takeaways for the team]
132	```
133
134	## If Connectors Available
135
136	If ~~monitoring is connected:
137	- Pull alert details and metrics
138	- Show graphs of affected metrics
139
140	If ~~incident management is connected:
141	- Create or update incident in PagerDuty/Opsgenie
142	- Page on-call responders
143
144	If ~~chat is connected:
145	- Post status updates to incident channel
146	- Create war room channel
147
148	## Tips
149
150	1. Start writing immediately — Don't wait for complete information. Update as you learn more.
151	2. Keep updates factual — What we k

People who liked this also viewed

6 picks

Type