incident-response
IT incident response and management procedures
When & Why to Use This Skill
This Claude skill provides a comprehensive framework for IT incident response and management. It streamlines the entire lifecycle of an issue—from initial triage and severity classification (P1-P4) to resolution and post-mortem documentation. By integrating standardized workflows, SLA tracking, and escalation matrices, it ensures IT teams can respond to system outages and security breaches with speed, consistency, and clear communication.
Use Cases
- Rapid Incident Triage: Automatically classify incoming IT issues into P1-P4 severity levels based on system impact and customer reach to prioritize resources effectively.
- SLA & Escalation Management: Guide support teams through strict resolution timelines and trigger the escalation matrix to notify managers or senior engineers when response targets are at risk.
- Standardized Stakeholder Communication: Generate professional status updates and resolution reports using built-in templates to keep stakeholders informed throughout the incident lifecycle.
- Root Cause Analysis & Knowledge Mapping: Facilitate post-incident reviews by documenting root causes and automatically updating the knowledge base to prevent future occurrences.
- Operational Consistency: Provide a step-by-step investigation and resolution playbook that ensures all team members follow the same high-standard procedures during high-pressure outages.
| name | incident-response |
|---|---|
| description | IT incident response and management procedures |
Incident Response Procedures
Objective
Guide structured incident response for IT support issues with proper escalation and communication.
Incident Severity Levels
Critical (P1)
- Production system down
- Security breach in progress
- Data loss occurring
- Multiple customers affected
Response: Immediate, all-hands SLA: 1 hour resolution or escalation
High (P2)
- Major feature broken
- Significant performance degradation
- Customer-facing issues
- Workaround not available
Response: Priority handling SLA: 4 hours resolution
Medium (P3)
- Non-critical feature broken
- Performance issues with workaround
- Internal tools affected
Response: Normal queue SLA: 24 hours resolution
Low (P4)
- Minor issues
- Enhancement requests
- Questions
Response: Best effort SLA: 72 hours response
Response Workflow
1. Triage (First 5 minutes)
- Acknowledge receipt
- Classify severity
- Assign to appropriate specialist
- Notify stakeholders if P1/P2
2. Investigation (Severity-dependent)
- Gather initial information
- Reproduce if possible
- Identify impacted systems
- Document timeline
3. Resolution
- Implement fix or workaround
- Test in safe environment
- Deploy with change control
- Verify resolution
4. Post-Incident
- Document root cause
- Update knowledge base
- Schedule post-mortem (P1/P2)
- Implement prevention measures
Communication Templates
Initial Response
Incident #{ID} acknowledged.
Severity: {LEVEL}
Assigned to: {SPECIALIST}
ETA for update: {TIME}
Status Update
Incident #{ID} Update
Status: {Investigating/In Progress/Resolved}
Current action: {DESCRIPTION}
Next update: {TIME}
Resolution
Incident #{ID} Resolved
Root cause: {DESCRIPTION}
Resolution: {DESCRIPTION}
Prevention: {RECOMMENDATIONS}
Escalation Matrix
| Severity | First Response | Escalate After | Escalate To |
|---|---|---|---|
| P1 | Immediate | 15 minutes | On-call manager |
| P2 | 15 minutes | 1 hour | Team lead |
| P3 | 1 hour | 4 hours | Senior engineer |
| P4 | 4 hours | 24 hours | Team lead |
Knowledge Base Integration
After resolution:
- Search for existing KB article
- Update if found, create if not
- Tag with relevant keywords
- Link to incident ticket