Incident Response
Defines severity levels, roles, triage steps, and communication protocols for production incident management.
What this file does
Defines severity levels, roles, triage steps, and communication protocols for production incident management.
When to use it
- Setting up an incident response process for a new team
- Standardizing how your team handles production outages
- Training new engineers on incident procedures
- Auditing your current incident response against best practices
name: incident-response description: Standard operating procedures for production incident management including severity classification, escalation paths, communication protocols, and postmortem processes.
Incident Response
This skill provides structured guidance for handling production incidents.
When to Declare an Incident
An incident should be declared when:
- A production service is degraded or unavailable for users
- Data integrity may be compromised
- A security breach is suspected
- SLA thresholds are at risk of being violated
Roles
| Role | Responsibility |
|---|---|
| Incident Commander (IC) | Owns the incident lifecycle, coordinates response, makes decisions |
| Communications Lead | Keeps stakeholders informed, posts status updates, manages the incident channel |
| Technical Lead | Drives root cause investigation, coordinates engineering fixes |
General Triage Steps
- Acknowledge - Confirm you are responding to the alert
- Assess - Determine severity using the severity-levels reference
- Communicate - Open an incident channel and notify stakeholders
- Escalate - Follow the escalation policy based on severity
- Mitigate - Apply immediate fixes to restore service
- Resolve - Confirm the issue is fully resolved and monitoring is clean
- Postmortem - Schedule and complete a blameless postmortem within 48 hours
Communication Expectations
- Status updates every 15 minutes for SEV1, 30 minutes for SEV2
- All communication happens in the incident Slack channel
- External customer communication is handled by the Communications Lead
- Management is notified per the escalation policy
Available References
severity-levels.md- Severity definitions (SEV1-SEV4) with impact and response timesescalation-policy.md- Who to page per severity level and escalation timelinespostmortem-template.md- Structured template for blameless postmortems
Available Scripts
page-oncall.sh- Page the on-call engineer via PagerDuty APIcreate-incident-channel.sh- Create a dedicated Slack incident channel
Available Assets
escalation-flowchart.mermaid- Visual flowchart of the escalation process
What's inside
7 sections: roles table, triage steps, communication expectations, and 3 reference file pointers.
Change this for your project
- Replace
severity-levels.mdwith your own severity definitions - Replace
escalation-policy.mdwith your own escalation contacts - Replace
postmortem-template.mdwith your own postmortem format - Replace
page-oncall.shwith your own paging script or service
Where it goes
Save as SKILL.md inside a skill folder. Loaded when the agent selects that skill.
Related Documents
Video Script
Guides an AI to write ready-to-film two-column AV scripts with hooks, segment breakdowns, B-roll cues, text overlays, timing estimates, and shot lists.
Image Generation Skill
Provides Python functions for generating, editing, and transforming images via DALL-E 3, FLUX (Replicate/fal.ai), and local Stable Diffusion, plus utilities and prompt engineering helpers.
AI Artist — Engineering Specification
Defines a 21-section engineering specification for a prompt construction skill, covering contracts, deterministic design, error taxonomy, and production readiness.
Karis
Turns an AI agent into a marketing CMO with brand analysis, SEO audits, Reddit monitoring, and viral tweet optimization via CLI or API.