Back to catalog / Agent workflows

Turn SRE incident evidence into a verifiable response brief

Use a focused agent to synthesize alerts, logs, and read-only checks while separating facts, hypotheses, and next verification.

Goal

Produce an incident brief for an on-call engineer to review from read-only evidence.

Create a fixture from synthetic alerts/logs and specify the time window, service, and known facts. [sre]
Follow the notebook’s Claude Agent SDK pattern to define an incident-response subagent with read-only tools and request a timeline, evidence, and uncertainties. [sre]
Check timestamps, sources, and hypothesis labels against the fixture; leave all change actions to the on-call engineer. [sre]

Every factual claim traces to input evidence, hypotheses are distinct from recommendations, and the agent made no changes.

When evidence conflicts, retain both original timestamps/sources and mark the issue unresolved rather than silently merging them.

Python 3.11+, Claude Agent SDK, an Anthropic API key, and synthetic incident evidence.

Use synthetic fixtures or approved read-only exports only; grant no write/deployment credentials.

The cookbook is a teaching demo; do not connect production control planes or automate restarts/releases, and do not replace incident command.

These values describe the upstream repository, not popularity or likes for an individual skill or playbook.

No metrics snapshot is available yet.

License: MIT