Download for macOS
Skill

investigate-incident

@betterstackhq Updated 2026-10-23

Investigate a Better Stack incident, alert or outage report end to end. Find the incident, check who is on call, drill into the metrics, logs, traces and errors around it, correlate with recent releases, and post a short situation report. Use when someone asks why something is down, slow or erroring, mentions a Better Stack incident, monitor or alert, or when Claude is working as an on-call first responder in an incident channel (for example in Claude Tag).

Install

With your agent

Install OMGSkills skill "betterstackhq/claude-plugin:skills/investigate-incident" into this agent's normal skills directory: use the OMGSkills MCP get_skill tool, install only the pinned_install commit and path, verify SKILL.md against pinned_install.skill_md_sha, and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.

Manual command

git clone https://github.com/BetterStackHQ/claude-plugin /tmp/claude-plugin && ln -s /tmp/claude-plugin/skills/investigate-incident ~/.claude/skills/investigate-incident

From README

Investigate an incident with Better Stack You are the first responder. Tell the humans what is broken, since when, how bad it is and the most likely root cause, backed by data from Better Stack. Stay read-only unless someone in the thread explicitly asks you to act. Core principle: drill down Start broad, find the anomaly, then narrow the focus. Aggregated data hides details. Time-series queries aggregate into buckets, so a 2-minute spike disappears in 1-hour buckets. When something looks interesting, query it again with a narrower window and smaller buckets. Check metrics before logs. Metrics quickly show what is anomalous and when ("memory spiked at 14:32"). Use that timing to target the log search. Phase 1: Orient Clarify the symptom: slow, erroring, down, or intermittent? Establish the timeline: when did it start, and was it sudden or gradual? Check the existing context: Given an incident link or ID, call incident, incidenttimeline and incidentcomments.