Skip to content
Beta Multi-model support (OpenAI, Gemini, and more) launching soon.
RBA RBA Skills

incident-runbook

v0.1.0 ExperimentalNo security review by Dakota Smith

Install

Pick the surface you use. Plugins run inside Claude Code, which is available in the terminal CLI, the desktop app on Mac and Windows, the web app at claude.ai/code, and the VS Code and JetBrains extensions. The slash commands are identical on every surface.

From inside any Claude Code session — terminal, desktop app, web app, or IDE extension:

  1. Add the RBA Skills marketplace (only needed once per machine):

    /plugin marketplace add rbaconsulting/rba-skills-plugin

  2. Install incident-runbook:

    /plugin install incident-runbook@rba-ai-hub

  3. Activate it without restarting:

    /reload-plugins

Overview

Monitoring & Incident Runbook Agent

Operational intelligence for RBA DX platform teams. This plugin provides a suite of skills and an autonomous agent for the full incident lifecycle — from initial alert triage through live investigation, remediation guidance, client communication, blameless post-incident review, and living-runbook updates.

Works across all RBA-managed platforms (Sitecore XM/XM Cloud, Optimizely, Umbraco, headless frontends) hosted on Azure App Service, Container Apps, or Azure Kubernetes Service — plus a provider-agnostic adapter path for AWS or on-prem workloads.

What's inside

Artifact Slug Purpose
Skill incident-triage Analyse Azure Monitor alerts, Application Insights exceptions, and Log Analytics query results to produce a structured triage summary — severity, blast radius, likely root cause, and first-response checklist.
Skill incident-summary Draft a concise internal incident summary (timeline, impact, resolution steps taken) from raw logs, alert history, and engineer notes — ready to paste into a Teams/Slack war room or ITSM ticket.
Skill incident-postmortem Facilitate a blameless post-incident review: produce a full postmortem document covering timeline, root cause analysis, contributing factors, corrective actions with owners and due dates.
Skill incident-runbook-update Compare a post-incident corrective-action list against an existing environment runbook and produce a targeted diff — adding new playbook steps, updating KQL queries, and flagging gaps.
Skill incident-alert-review Audit an Azure Monitor alert ruleset for coverage gaps, alert fatigue (noisy thresholds), missing action groups, and KQL query correctness — returns a prioritised improvement plan.
Agent incident-responder Autonomous subagent that executes the full first-response sequence: reads alert context, queries Log Analytics, identifies blast radius, assembles a triage card, and routes to the right playbook.
Command incident Slash-command entry point — reads the current terminal/editor context and routes to the most appropriate incident-runbook skill.

When to use this plugin

  • Active incident response — engineer receives a PagerDuty/Azure Monitor alert at 2 AM and needs immediate structured guidance without trawling documentation.
  • War-room coordination — quickly produce a shareable incident summary for stakeholders and client contacts while the team investigates.
  • Post-incident learning — run incident-postmortem the day after to produce a complete blameless review document ready for the client or internal ops review.
  • Runbook hygiene — after every postmortem, use incident-runbook-update to close the gap between "what happened" and "what the runbook says".
  • Alert tuning — use incident-alert-review quarterly or after a noisy incident to tighten alert thresholds and eliminate duplicate rules.
  • Onboarding — new on-call engineers can use incident-triage interactively with synthetic alert payloads to practise the response workflow before they go live on-call.

How to install

claude plugin install incident-runbook@rba-ai-hub

Then invoke any skill directly from the CLI or from within a Claude Code session:

/incident-triage paste Azure Monitor alert JSON here
/incident-summary "Database connection pool exhaustion, 14:35–15:02 UTC, 3% of requests affected"
/incident-postmortem P1 incident 2026-05-14 — Sitecore content API returning 503
/incident-runbook-update compare RUNBOOK-prod.md against today's postmortem actions
/incident-alert-review review alert rules in rg-workload-prod-uks
/incident

Or let the incident-responder agent drive the full first-response sequence autonomously.

Platform adapters

All skills default to Azure Monitor / Log Analytics as the observability stack. State your platform in the prompt to activate the relevant adapter:

Platform hint Adapter behaviour
Sitecore XM Cloud Adds XM Cloud-specific error signatures, content delivery API SLIs, GraphQL timeout patterns
Optimizely Adds Optimizely experimentation service health checks, CDN cache-miss patterns
Umbraco Adds Umbraco Cloud health endpoint checks, Examine index rebuild playbooks
Headless / Next.js Adds Vercel/Azure Static Web Apps edge function error patterns
AWS Swaps CloudWatch Insights queries in place of KQL; maps SNS alerts to Azure Monitor equivalents

Permissions

Each skill uses least-privilege tool grants declared in its SKILL.md. No skill writes to credential directories or executes deployment commands — remediation steps are always generated as human-readable procedures, not executed automatically. The incident-responder agent is read-only: it queries logs and reads files; it does not deploy, scale, or restart services without explicit human approval.

  • Cloud & DevOps Accelerator — generates the environment runbooks that incident-runbook-update amends.
  • Security Readiness Reviewer — surfaces security misconfigurations that become incident contributors.
  • Client Status Reporter — transforms incident summaries into client-facing status update emails and status-page entries.

Bundled artifacts

Skills

  • incident-runbook-update — Compares a post-incident corrective-action list or postmortem against an existing environment runbook and produces a targeted diff — adding missing playbook steps, updating stale KQL queries, closing escalation-path gaps, and versioning the runbook. Designed to run immediately after every postmortem to keep living runbooks current.
  • incident-summary — Drafts a concise, structured incident summary from raw logs, alert history, engineer notes, or a triage card. Produces two artefacts: an internal technical summary (for the war room and ITSM ticket) and a client-facing status update (plain language, no internal jargon). Covers the full detection-to-resolution timeline.
  • incident-triage — Analyses Azure Monitor alert payloads, Application Insights exceptions, or raw log excerpts to produce a structured triage card — severity classification, blast-radius estimate, likely root cause hypotheses, and a first-response checklist. Works across Sitecore, Optimizely, Umbraco, and headless DX stacks on Azure.
  • incident-postmortem — Facilitates a blameless post-incident review for a resolved DX platform incident. Produces a complete postmortem document: timeline, five-whys root cause analysis, contributing factors, corrective actions with owners and due dates, and a lessons-learned section. Follows Google SRE and ITIL-aligned blameless principles.
  • incident-alert-review — Audits an Azure Monitor alert ruleset for a DX environment — identifying coverage gaps, alert fatigue sources (over-sensitive thresholds, duplicate rules, missing deduplication), broken action groups, and KQL query errors. Produces a prioritised improvement plan with ready-to-apply Bicep or CLI commands for each fix.

Agents

  • incident-responder — Autonomous first-responder subagent for active DX platform incidents. Reads alert context, queries Azure Log Analytics, estimates blast radius, and assembles a triage card — then routes to the matching runbook playbook if one exists. Read-only: never deploys, scales, or restarts services without explicit human approval.

MCP Servers

  • azure-devops — Microsoft Azure DevOps MCP Server — exposes pipeline runs, work items, and pull requests. Used by incident-runbook skills to correlate incidents with recent deployments and to create/update incident work items. Set AZURE_DEVOPS_ORG and AZURE_DEVOPS_PAT in your environment before use.
  • mcp-atlassian — mcp-atlassian (sooperset/mcp-atlassian) — Jira Cloud MCP server. Enables incident-summary and incident-postmortem skills to create and update Jira incident tickets directly. Set JIRA_URL, JIRA_USERNAME, JIRA_API_TOKEN in your environment. Optional for teams using Jira as their ITSM.

Slash Commands

  • /incident — Slash-command entry point for the Monitoring & Incident Runbook bundle. Reads the current context (alert payload, open files, or prompt text) and routes to the most appropriate skill: incident-triage for active incidents, incident-summary for war-room updates, incident-postmortem for post-resolution reviews, incident-runbook-update for runbook hygiene, or incident-alert-review for proactive alert tuning.
Technical details
Homepage
https://rba-skills.tylerschroeder.net/plugins/incident-runbook/
License
MIT
Maturity
experimental
Security review
No security review
Owners
  • engineering
  • delivery
Platforms
azure, azure-devops
Disciplines
engineering, delivery
Lifecycle
operate
Tags
  • incident
  • runbook
  • monitoring
  • sre
  • alerting
  • postmortem
  • observability
  • on-call
  • azure-monitor
  • application-insights
  • log-analytics
  • kql
  • sitecore
  • optimizely
  • umbraco
Last updated
by Tyler Schroeder
Source
plugins/incident-runbook/

Edit this plugin's README on GitHub — opens GitHub's web editor. No git knowledge needed.