incident_response

Files (1)

• SKILL.md

SKILL.md (first lines)

# Incident Response & Outage Triage

> Standard operating procedure for high-severity production incident triage and remediation.

tags: [incident-response, outage, sre, triage, alert, postmortem]

## Safety Rules
* Protect live customer traffic first before deep debugging.
* Prefer safe rollback or failover over unverified in-place hotfixes.
* Capture timeline, logs, and telemetry before recycling instances to preserve forensic evidence.
* Require explicit sign-off from human engineer for any mutating action during active incidents.

## Triage Procedure
1. **Assess Impact & Scope**: Determine impacted services, error rate percentage, and latency spikes.
2. **Identify Recent Changes**: Check git commit log, CI/CD deployment history, or recent cluster modifications.
3. **Collect Telemetry**: Correlate errors in application logs, reverse proxy statuses, and host metrics.
4. **Formulate Hypothesis & Plan**: Identify root cause, formulate remediation, calculate risk.
5. **Human Approval**: Present proposed remediation with risk classification.
6. **Execute & Verify**: Apply approved fix and verify error rate drops back to normal.

From NotHarshhaa/argus-agent, MIT.

More from NotHarshhaa/argus-agent