「incident」の検索結果

[omh] Production is down or an incident is open: command an incident that is still open -- severity as declared live state, commander and roles, an append-only timeline, a recorded temporary mitigation, verified recovery, and the customer notice. Use when the user says: live-incident-response, live incident response, incident response, active incident, ongoing incident, open incident, incident open, incident commander.

日本語の概要は準備中です。原文の説明を表示しています。

Manage active production incidents through detection, triage, mitigation, communication, and resolution with structured roles and decision-making. Use this skill whenever the user has an active incident, a production issue, a service outage, a security incident, or needs to plan incident response procedures. Triggers on incident response, production incident, outage, service down, site down, P0, P1, severity, downtime, on-call, incident commander, status page, postmortem prep. Also triggers when something is actively broken in production and the user is figuring out what to do.

日本語の概要は準備中です。原文の説明を表示しています。

Write the postmortem for an incident, in its incident channel, once it is mitigated or resolved. Use on "write up this incident", "postmortem", "incident summary", "what happened here for people who weren't around", "draft the retro", or when the oncall memory says incidents of this severity get one. Reads the incident channel (and the alert thread it came from), the investigation findings and the data behind them, and writes a one-screen, zero-context write-up: what happened, impact with numbers, detection, timeline with durations, why it happened, what fixed it, follow-ups with proposed owners, and one before/during/after chart. Posted and pinned in the incident channel as its final pinned post, with edit requests updating that one pinned post in place — unless the person or the team's conventions say write-ups live elsewhere, in which case it is written there and only a link is posted, nothing pinned. A person edits and publishes it; never assigns blame.

日本語の概要は準備中です。原文の説明を表示しています。

システムログを分析してエラーの根本原因を特定し、段階的に深堀りしていくデバッグ専門家スキル。 アプリケーションログ、システムログ、クラウドサービスログなど様々な形式に対応。 5 Whys、タイムライン分析、Fishbone分析などのRCA（根本原因分析）手法を用いて 問題の本質を突き止め、再発防止策まで提案する。 Use when analyzing system logs to find error root causes, debugging application issues, or performing technical post-mortem analysis with log data. For organizational incident management processes (post-incident review, corrective action plans, incident reports without log data), use incident-rca-specialist instead. Triggers: "analyze this log", "find the root cause", "debug this error", "why is this failing", "log analysis", "what caused this crash", "troubleshoot this issue"

Prepares a DRAFT data incident impact brief from the incident notes and data inventory the user provides: the timeline as stated, systems involved matched to the inventory, data categories held and evidenced as involved, people and record counts potentially affected with the source and method behind every figure, third parties, notification questions for legal and the data protection officer, and every UNKNOWN with the evidence that would settle it. No legal determination: it never states whether the incident is a reportable breach, whether notice is due, to whom or by when. Use when the user asks to "prepare the impact brief for this incident", "what data was involved", "how many people are affected", "map the incident to our data inventory" or "pull together what legal needs on the incident". Do not use for the blameless postmortem or root-cause timeline, use incident-postmortem-drafter instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Drafts a blameless incident postmortem (summary, impact, timeline, detection and response, contributing factors as candidates for review, action items) from an incident channel export, ticket notes and any alert or change records, with UNKNOWN for every fact the inputs do not contain. Never assigns blame, names a root cause or re-rates severity. Use when the user asks to "write the postmortem for this incident", "build the incident timeline from the chat export", "draft the post-incident review" or "turn this ticket and channel log into an incident report". Do not use for a knowledge article from the resolved ticket, use knowledge-article-drafter instead; for project retrospectives, use lessons-learned-synthesis; for data-breach impact and notification questions, use data-incident-impact-brief. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Post a sitrep (situation report) for a live incident, in its incident channel: a short fixed-layout update for people who haven't read the whole channel — the current picture and what moved since the previous update. Use on "sitrep", "status update", "where are we", "what's the latest", "catch me up", "summarize the incident so far", when asked to keep posting on a schedule ("post a sitrep every hour until resolved"), or when the oncall memory sets an update cadence for this severity and the incident owner asks Claude to keep it. Reads the channel, alert thread and findings posted, re-reads the one key signal, and writes: status line, TL;DR, impact, what changed since the last sitrep, what's in progress and who has it, what's needed, when the next update comes, one chart. Facts come only from what people said or Claude read first-hand; cause and recovery time are never guessed. Fits one phone screen. Not investigation (`incident-investigate`) or the write-up afterwards (`incident-postmortem`).

日本語の概要は準備中です。原文の説明を表示しています。

Run a structured incident response. Use when the user says "we have an incident", "production is down", "service is degraded", "on-call response", "p0 incident", "something is broken in prod", "help me manage this incident", "incident commander", or there is an active production issue requiring coordinated response - even if they don't explicitly say "incident response".

日本語の概要は準備中です。原文の説明を表示しています。

インシデント発生後の振り返りと根本原因分析を体系的に実施するスキル。 ログファイル解析や技術デバッグが必要な場合は log-debugger を使用すること。 本スキルはインシデント管理プロセス（タイムライン構築、影響評価、 是正措置計画、再発防止策）に特化する。ログデータの分析ではなく、 組織的な振り返りプロセスと是正措置の策定が主目的である。 Use when conducting post-incident reviews without log analysis, creating corrective action plans, or performing organizational root cause analysis focused on process improvement. NOT for log file debugging. Triggers: "post-incident review", "corrective action plan", "incident report作成", "再発防止策", "RCAレポート", "是正措置", "インシデント振り返り"

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Automatic init the first time Claude acts in an incident or alerts channel — one named like #inc-…, #incident-…, #sev0-…/#sev1-…, or whose recent messages are pages or alerts from PagerDuty, Opsgenie, incident.io, Datadog, Sentry or Grafana, or relayed by people (talk about being paged is not an alert) — that isn't already a team's oncall / monitoring channel. Run once per channel, on first contact (just invited, first @-mention, channel just created), before doing what was asked: load the oncall memory oncall setup wrote to shared workspace memory, pick the owning team's section, work out which monitoring / paging / code tools Claude can reach and which are missing, post one short zero-context message, note findings in this channel's memory, then hand off to `incident-investigate` if something was asked — or immediately, unasked, when the channel was plainly opened for a live outage. Works with no oncall memory (offers setup once). Also on "load the oncall setup here" / "init this incident".

日本語の概要は準備中です。原文の説明を表示しています。

Investigate Azure incidents and service degradations with a read-only workflow using Azure CLI, Resource Health, Activity Log, metrics, resource logs, and official Microsoft docs. Use when troubleshooting Azure outages, Resource Health alerts, Azure Firewall or DNS failures, ExpressRoute or BGP instability, VM availability problems, AKS incidents, App Service failures, database connectivity issues, Entra ID sign-in problems, load balancer issues, platform-vs-workload cutover, or drafting a troubleshooting report. Triggers on 'Azure トラブルシューティング', '障害調査', '切り分け', 'Resource Health', '復旧確認', 'Azure Firewall', 'DNS', 'ExpressRoute', 'VPN Gateway', 'BGP', 'AKS', 'App Service', 'SQL', 'PostgreSQL', 'Cosmos DB', 'Entra ID', 'incident', 'degraded', 'unavailable'.

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Use when working with Allma — allma incident management, collaboration workflows, post-incident learning, and channel orchestration. Covers incident creation via Slack, timeline tracking, stakeholder communication, automated workflows, and retrospective analysis. Use when managing active incidents, reviewing post-incident learnings, or analyzing incident patterns in Allma.

日本語の概要は準備中です。原文の説明を表示しています。

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana to provide SOC analysts and leadership with situational awareness during active incidents, tracking affected systems, containment status, IOC spread, and response timeline. Use when IR teams need unified visibility during incident coordination and post-incident reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive incident response framework from detection through resolution and post-incident review. Battle-tested SRE/DevOps practices: severity classification, timeline reconstruction, structured post-incident analysis. Use when declaring an incident, coordinating multi-team response during an outage, leading a post-mortem, or setting up on-call practices for a new service.

日本語の概要は準備中です。原文の説明を表示しています。

Triage, contain, recover, and review Adobe auth, product, async-job, event, storage, spend, or App Builder incidents with evidence. Use when the task requires adobe integration incident command. Trigger with "Adobe incident", "Firefly outage", or "Adobe credential leak".

日本語の概要は準備中です。原文の説明を表示しています。

Expert SRE incident responder specializing in rapid problem resolution, modern observability, and comprehensive incident management. Masters incident command, blameless post-mortems, error budget management, and system reliability patterns. Handles critical outages, communication strategies, and continuous improvement. Use IMMEDIATELY for production incidents or SRE practices.

日本語の概要は準備中です。原文の説明を表示しています。

Run a blameless postmortem for an incident caused by an AI agent or LLM feature — hallucinated facts shipped to users, runaway tool use, prompt injection, cost blowouts, or wrong actions taken autonomously. Use when asked to write up an AI incident, analyse why an agent did something wrong, or produce corrective actions after an LLM failure. Produces a structured postmortem with trace reconstruction, a root-cause layer analysis, and corrective actions including a permanent regression case. For non-AI production incidents use incident-postmortem.

日本語の概要は準備中です。原文の説明を表示しています。

Assess, report, and manage serious incidents involving high-risk AI systems under Article 73 EU AI Act. Covers incident qualification, deadline buckets (2/10/15 days), authority notification, deployer duties (Art. 26(5)), cross-regulation mapping (GDPR/NIS2/MDR), corrective measures, and DACH-specific routing. Use when asked to evaluate whether an AI incident is reportable, draft an Article 73 notification, identify the right authority, or build an AI incident response process.

日本語の概要は準備中です。原文の説明を表示しています。

Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Use when: (1) User reports a data breach or security incident — including "is this even a personal data breach?" triage, (2) User asks about breach notification obligations or deadlines, (3) User mentions "72 hours", Art. 33, Art. 34, or notification requirements, (4) Discussion involves security incidents affecting personal data, (5) User needs breach risk assessment using ENISA methodology, (6) User mentions "Data Breach" or "Incident" or "Data Leakage" or "Ransomware" or "Exfiltration", (7) User needs to determine Controller vs Processor obligations, (8) Cross-border breach scenarios requiring Lead SA determination, (9) User needs a mitigation playbook or immediate response recommendations, (10) User needs audit-ready breach documentation (.docx) or an EDPB-template-aligned breach notification / evidence file — including follow-up and withdrawal notifications, (11) Breach involves an AI system requiring AI Act Art. 73 serious incident screening.

日本語の概要は準備中です。原文の説明を表示しています。

Expert in running effective incident postmortems. Covers blameless analysis, root cause investigation, action item prioritization, and building a learning culture. Understands that incidents are opportunities to improve systems, not punish people. Use when "postmortem, incident review, what went wrong, root cause, blameless, outage, post-incident, " mentioned.

日本語の概要は準備中です。原文の説明を表示しています。