investigate-incident

Incident investigation involves following alert-specific runbooks to gather logs, metrics, and pod status information systematically. This skill automates evidence collection and guides you through root cause analysis for Kubernetes platform incidents, reducing resolution time.

Use structured incident response to collect pod events, logs, and application status. This skill applies diagnostic workflows to determine why pods fail to start, document findings in incident reports, and track remediation steps for future reference.

Root cause analysis documentation captures evidence, findings, and remediation in structured incident reports stored in `TODO_INCIDENTS.md`. This creates a record for post-incident learning and tracks how each alert was resolved.

Yes, automated evidence collection runs pre-defined commands to pull logs, metrics, events, and application status without manual tool-switching. This reduces the risk of missing critical information during investigations.

Structured incident documentation workflows guide evidence gathering and RCA generation, producing comprehensive reports that support operations runbooks and enable knowledge sharing across your team.