kata-incident-triage

Guides incident responders through first-15-minute triage with runbook-driven diagnosis and mitigation-first recovery.

Updated Sep 3, 2025

Search Tags:#on-call #mitigation #runbooks #severity #incident triage #post-incident timeline #war room coordination

One-click install

npx skills add https://github.com/guardiatechnology/design-system --skill kata-incident-triage

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: kata-incident-triage
Source: https://github.com/guardiatechnology/design-system/tree/main/.claude/skills/kata-incident-triage
Command: npx skills add https://github.com/guardiatechnology/design-system --skill kata-incident-triage

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents slow, chaotic early incident response by giving an ordered procedure to acknowledge alerts, declare severity, coordinate roles, perform initial diagnosis, and choose mitigation quickly.

Core Features & Use Cases

First-15-min triage workflow: acknowledge within 5 minutes, declare SEV-1 to SEV-4 objectively, and open the correct war-room/role activation.
Runbook-driven diagnosis: consult alert runbooks, capture dashboard/log/trace findings with timestamps, and list hypotheses in a testable order.
Mitigation-first recovery: decide rollback vs forward-fix using deployment/migration/data impact heuristics, apply the mitigation, and verify recovery within 10 minutes.
Structured communication outputs: produce a channel-ready severity/activations message, a timeline for the IC, and status-page/executive updates when required.
Use case: during a production latency spike in a service like refund-api, run the triage steps to determine severity, gather early evidence from dashboards/logs/traces, mitigate via rollback or other safe actions, verify recovery, and document a timeline for investigation.

Quick Start

Ask the AI to act as an incident scribe and produce a complete incident triage plan for your next alert using the required steps, outputs, and SEV criteria from the skill.

Frequently Asked Questions about kata-incident-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I structure incident triage during the first 15 minutes of a production outage?▼

Runbook-driven incident triage works by consulting alert runbooks, capturing dashboard, log, and trace findings with timestamps, and listing hypotheses in a testable order to guide mitigation decisions.

How do I determine the correct severity level for an active production incident?▼

During incident triage, you decide between rollback and forward-fix by using deployment, migration, and data impact heuristics to apply mitigation-first recovery and verify service health within 10 minutes.

Can I use this incident triage workflow for latency spikes and data corruption risks?▼

Incident triage generates structured communication outputs including a channel-ready severity message, a post-incident timeline for the incident commander, and status-page or executive updates when required.

Why does my incident response team struggle to stabilize service health regressions quickly?▼

Slow incident response often happens when teams lack an ordered procedure to acknowledge alerts, declare severity objectively, and apply mitigation-first decision making within the critical first 15 minutes.