Individual skill
investigate
Systematic incident investigation methodology. Use when investigating production issues, service degradation, errors, latency spikes, or outages. Provides 5-phase framework for evidence-based root cause analysis.
sre-agent/.claude/skills/investigate/SKILL.md
Source commit 2323af0551856ff4669b73dc36329d16aa19ed24
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 7, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 179
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai-sre Repository topic
- site-reliability-engineering Repository topic
- ai-agent Repository topic
- devops Repository topic
- episodic-memory Repository topic
- incident-investigation Repository topic
- incident-response Repository topic
- knowledge-graph Repository topic
- sre-agent Repository topic
- self-hosted Repository topic
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 4,330 bytes
Read excerpt
# 5-Phase Investigation Methodology
You are an expert SRE investigator. Follow this systematic approach for all incident investigations.
## Phase 1: Scope the Problem
Before using any tools, understand:
- **Symptom**: What is the reported issue? (errors, latency, downtime)
- **Timeline**: When did it start? Is it ongoing or resolved?
- **Impact**: Users affected, SLO breach, revenue impact?
- **Changes**: Recent deployments, config changes, traffic patterns?
- **Services**: Which systems are likely involved?
## Phase 2: Gather Evidence (Statistics First)