incident-response

Automating incident response for CloudWatch and Prometheus alarms involves classifying severity, generating hypotheses, querying MCP servers for diagnostics, and executing remediation steps based on the identified runbook.

Classifying incident severity from triggered CloudWatch alarms involves evaluating the alarm metrics, looking up the corresponding runbook, generating diagnostic hypotheses, and determining the appropriate remediation execution level based on the severity.

Yes, MCP servers are required for diagnostic queries. The incident response workflow specifically requires the awslabs.cloudwatch-mcp-server and awslabs.prometheus-mcp-server dependencies to execute diagnostic queries and gather alarm metrics.

Yes, this incident response automation works with Prometheus alarms. It handles the full workflow from Prometheus alarm triggers, including severity classification, hypothesis generation, and remediation execution.

The best way to handle incident remediation execution for CloudWatch alarms is to automate the workflow: classify the alarm severity, identify the correct runbook, generate diagnostic hypotheses, query MCP servers, and execute the remediation steps automatically.

Automated incident response requires runbook lookup and hypothesis generation to ensure the system identifies the correct diagnostic queries and executes the appropriate remediation steps based on the specific alarm and its classified severity level.