build_incident_timeline
Correlate already-fetched VMware events into one incident timeline, surfacing anomalous spikes, ranked root-cause hypotheses and next diagnostic checks. Does not fetch events itself.
Instructions
[READ] Correlate already-fetched VMware events into one incident view.
WHEN: use this after you've pulled events for an incident from the data-source skills (vmware-monitor get_events/get_alarms, vmware-aria list_alerts/list_anomalies, vmware-log-insight search_logs/aggregate_logs, vmware-nsx) — feed them here to find what correlates and where to look next. Not sure which events to pull? Run list_symptom_categories first. This tool does NOT fetch anything itself.
RETURNS: {event_count, window, binning, classification, spikes
(strongest anomalous bins), spikes_total, hypotheses (ranked
root-cause candidates, each with a suggested_check), next_checks (which
skill/tool to run next)}. Read binning for the resolution you were
given, and classification for how much of the stream matched nothing —
the ranking describes only the part that did.
GOTCHAS: read-only, stateless, no network — nothing is executed. Remediation routes to vmware-aiops (single fix) or vmware-pilot (multi-step). A malformed event returns {error, hint} naming the offending index.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| top_n | No | How many ranked hypotheses come back (default 5). Spikes are capped separately at 20, true count in 'spikes_total'. | |
| events | Yes | Event envelopes, each {ts, source, severity, entity, text, fields}. ts may be ISO-8601, epoch seconds or epoch millis and is required; severity is normalised onto critical/error/warning/ info/unknown, so vendor spellings (fatal, red, warn, yellow, notice, green) are accepted. An entry that cannot be normalised is refused with its index, not skipped. Keep each event's event_type in fields — vmware-monitor's get_events returns it, and the symptom classifier matches it alongside the message. On a modern EventEx the message is generic boilerplate and the eventTypeId is the only thing that says what happened, so dropping it turns a readable event into an uncategorized one. | |
| bin_seconds | No | Time-bin width in seconds. Omit and it is chosen from event density off the ladder 1/10/60/300/900/3600/21600/86400, taking the finest width still averaging 4 events per bin. | |
| z_threshold | No | Standard deviations above the mean bin count that mark a spike (default 2.0). Under 3 bins, or a flat series, yields none at any threshold — empty spikes is not "calm". |