incident-triage-snapshot
Read-only
Aggregate incident metadata, related events, similar past incidents, and log-spike detection into a single structured response for rapid incident triage.
Instructions
Aggregated incident triage: get-incident + get-events (lookback window) + search-incidents (similar on same service, last 14d) + aggregate-logs (error spike on incident's service) in one call. Replaces the 5-step triage-incident Prompt orchestration with a single structured response (incident metadata, related events, similar past incidents, log-spike heuristic, and a summary block with severity/duration/spike flag). Uses Promise.allSettled — per-fetcher failures populate caveats[].
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| incidentId | Yes | Incident ID. Use list-incidents or search-incidents to find one. | |
| lookbackMinutes | No | Minutes before incident creation to scan for related signals (default 60, max 720) | |
| service | No | Override the service tag scan. By default, derived from incident.fields.services[0]. | |
| includeLogSpike | No | Run an aggregate-logs spike detection over the window for the incident's service | |
| includeSimilar | No | Search for incidents on the same service in the last 14 days | |
| extractFields | No | Comma-separated dotted paths to project from response (e.g. 'id,name,owner.name,columns.*.name'). Use `*` as wildcard for arrays/objects. Wrap field names with dots in backticks. Reduces response tokens dramatically on large entities. |