aiops-autonomous-incident-response

Diagnose Kubernetes, Prometheus, and Airflow incidents from alerts and draft RCA reports.

14|1|Updated May 5, 2026

Search Tags:#kubernetes #incident response #airflow #prometheus #aiops #rca generation #slack approvals

Ready to run

npx skills add https://github.com/ivanshamaev/de-agent-skills --skill aiops-autonomous-incident-response

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: aiops-autonomous-incident-response
Source: https://github.com/ivanshamaev/de-agent-skills/tree/main/group_skills/infra_dataops_group_skills/aiops_autonomous_incident_response
Command: npx skills add https://github.com/ivanshamaev/de-agent-skills --skill aiops-autonomous-incident-response

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill reduces MTTR by autonomously diagnosing data platform incidents from alert signals and assembling a structured draft for RCA and runbook actions.

Core Features & Use Cases

Alert-to-diagnosis loop: classifies severity, then runs an LLM-driven diagnosis workflow using Kubernetes, Prometheus, Airflow metadata, and pod logs to confirm likely failure modes.
Automated RCA draft generation: correlates logs/metrics/events into a failure taxonomy and produces an incident report suitable for postmortem follow-up.
Self-healing with approval gate: executes only low-risk corrective actions automatically and routes medium/high-risk actions through Slack for human approval.

Quick Start

Use the aiops-autonomous-incident-response skill to handle an Alertmanager firing alert for your data platform and produce an incident report with recommended follow-up actions.

Frequently Asked Questions about aiops-autonomous-incident-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate incident diagnosis for Kubernetes CrashLoopBackOff and OOMKilled alerts?▼

Automating incident diagnosis for Kubernetes CrashLoopBackOff and OOMKilled alerts uses an alert-driven loop to classify severity and correlate pod logs, Prometheus metrics, and Airflow metadata. This autonomous incident response confirms the failure mode and produces an RCA draft to reduce MTTR.

Can I use Slack approvals to gate risky self-healing actions during an Airflow incident response?▼

Yes, you can use Slack approvals to gate risky self-healing actions during an Airflow incident response. The automated workflow executes only low-risk corrective actions immediately, while routing medium and high-risk recovery operations through Slack to require explicit human approval before execution.

What is the best way to generate an RCA draft from Prometheus alert signals and failed DAG tasks?▼

The best way to generate an RCA draft from Prometheus alert signals and failed DAG tasks is through an autonomous incident response workflow that correlates metrics, logs, and events into a failure taxonomy. This produces a structured incident report with a timeline and recommended runbook actions suitable for postmortem follow-up.

Does autonomous incident response work with both Kubernetes pod failures and Airflow DAG task errors?▼

Yes, autonomous incident response works with both Kubernetes pod failures and Airflow DAG task errors. The automated diagnosis workflow targets Kubernetes events like CrashLoopBackOff and OOMKilled, alongside Airflow-based failure scenarios such as failed DAG tasks, by analyzing metadata and pod logs to confirm likely failure modes.

How do I route recovery actions based on alert severity during a data platform incident?▼

Routing recovery actions based on alert severity during a data platform incident is handled by classifying the alert and executing only low-risk corrective actions automatically. Medium and high-risk recovery actions are routed through Slack approval gating to ensure human oversight before any risky healing is executed.

When should I not use fully automated self-healing for data platform incidents?▼

You should not use fully automated self-healing for data platform incidents when the required recovery actions are classified as medium or high risk. These risky healing actions must be routed through Slack for explicit human approval, ensuring that potentially destructive or impactful operations are not executed without oversight.