skills.rest
theLightArchitect
theLightArchitectCOMMUNITY
Explore all skills by this author →
GitHub

escalation

Rank escalation options for token-limited CAPPY investigations and log attempts to inv_context.json.

Updated Aug 27, 2026
Search Tags:#investigation#logging#escalation#incident-management#tac#context-budget#cortex
One-click install
npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill escalation-thelightarchitect
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: escalation
Source: https://github.com/theLightArchitect/cappy-toolkit/tree/main/skills/escalation
Command: npx skills add https://github.com/theLightArchitect/cappy-toolkit --skill escalation-thelightarchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents investigations from running out of context or becoming stuck by providing a structured decision tree and recovery actions when token budgets are low, phase gates repeatedly block progress, or investigations deadlock and require human expertise.

Core Features & Use Cases

  • Context budget detection: Detects token-budget thresholds (warning and critical) and evaluates whether remaining context can complete remaining phases.
  • Prioritized recovery options: Presents ordered choices (human approval, summarize & deliver, skip or narrow research, manager handoff) with effort, impact, and success-rate guidance.
  • Escalation orchestration & logging: Exposes methods to compute options, identify contacts, decide auto-recovery feasibility, and log all attempts to inv_context.json for auditability.
  • Use Cases: Handling investigations that hit the 85%+ token threshold, phase gates blocked multiple times, or investigations attempted 3+ times without progression; supports TAC handoffs and managerial approval flows.

Quick Start

Ask CAPPY to evaluate investigation SF-03896040 with tokens_used 75500 and tokens_budget 85000 and present prioritized escalation options.

Frequently Asked Questions about escalation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I handle incident investigations that run out of context budget in Cortex XSOAR?▼

Incident investigations running out of context budget can use structured escalation options to recover by prioritizing actions like human approval, summarize-and-deliver, scope narrowing, or manager handoff when token limits are reached.

What are the best escalation options when a Cortex XSIAM investigation hits a token limit?▼

The best escalation options for token-limited investigations include human approval, summarize-and-deliver, skip or narrow research, and manager handoff, ranked by effort, impact, and estimated success rate to guide recovery.

When should I trigger an escalation during incident management workflows?▼

Trigger incident escalation when token usage hits 85%+ of the budget, phase gates block progress multiple times, or investigations attempt execution 3+ times without progression and require human expertise.

Does Cortex XDR investigation support automatic logging of escalation attempts?▼

Cortex XDR investigation escalation workflows log all recovery attempts to inv_context.json, recording computed options, identified contacts, and auto-recovery feasibility decisions for full auditability.

Can I automate recovery decisions for blocked phase gates in XSOAR investigations?▼

Recovery decisions for blocked phase gates can be evaluated for auto-recovery feasibility by computing remaining tokens, ranking available recovery paths, and returning contact details for human decisioning when automatic resolution is not possible.

What is context budget detection and how does it work for incident investigations?▼

Context budget detection evaluates remaining tokens against warning and critical thresholds during an investigation to determine whether the available context window can complete the remaining phases before exhaustion.

Related Skills

Explore More Software Engineering Skills→
BarisSozenBarisSozen
1

error-logger

Generate structured JSON logs with correlation IDs for distributed services.

Community
Basic
AgenticAIPlanAgenticAIPlan
10

agent-boundary-design

Design agent boundaries with autonomous actions, human confirmation, and refusal rules.

Official
Advanced
atlassianatlassian
949

search-company-knowledge

Search Confluence, Jira, and internal documentation with synthesized, cited answers.

Official
Intermediate
jinwoonghongjinwoonghong

moai-foundation-context

Manage token budgets and persist session state for multi-agent workflows.

Community
Advanced