[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M69BCYYX7Z0WF9AHM27XSA60":3,"skill-same:01M69BCYYX7Z0WF9AHM27XSA60":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":21,"linkOnly":22,"markdownContent":23,"markdownBody":24,"frontMatter":25,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":33,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M69BCYYX7Z0WF9AHM27XSA60","triage-alerts",null,"Triages a batch of alerts by severity and urgency, producing a prioritized action plan.","microsoft\u002FGHCP-Lab","microsoft","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6154722?v=4","01M698VYDXZ6JW5WH3CRV650R8","Microsoft","01M69BCR415K290AFR6PNPGD8F",46,"MIT","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FGHCP-Lab\u002Fblob\u002Fmain\u002Fplugins\u002Falert-toolkit\u002Fskills\u002Ftriage-alerts\u002FSKILL.md",[],[19,20],"triage","triage alerts","2026-11-10 10:12:30",false,"---\nname: triage-alerts\ndescription: Triages a batch of alerts by severity and urgency, producing a prioritized action plan.\nargument-hint: \"[alert-data-source]\"\n---\n\n# Triage Alerts Skill\n\n## When to Use\n\nUse `\u002Ftriage-alerts` when you need to:\n- Process a large batch of incoming alerts and determine response priority\n- Create an incident response checklist with SLA-driven deadlines\n- Distribute alerts across team members based on severity and availability\n- Track escalation paths for critical events\n- Organize alert response workload by urgency and impact\n\nThis skill is especially useful during security incidents, monitoring system maintenance, or routine alert reviews.\n\n## Triage Rules\n\nThe skill applies strict SLA-based triage rules to classify alerts into action buckets:\n\n### Critical Severity\n- **Response Time**: Must be triaged and acknowledged within **1 minute**\n- **Action**: Immediate escalation to security team lead and on-call personnel\n- **Handling**: Drop everything and respond; activate incident response protocols\n- **Notification**: Page + Email + SMS to escalation list\n\n### Error Severity\n- **Response Time**: Must be reviewed and acknowledged within **15 minutes**\n- **Action**: Assign to primary responder; investigate root cause\n- **Handling**: High priority; address before routine work\n- **Notification**: Email + In-app alert to assigned team\n\n### Warning Severity\n- **Response Time**: Must be processed within **1 hour**\n- **Action**: Log for trend analysis; investigate if correlated with other alerts\n- **Handling**: Normal priority; part of standard monitoring workflow\n- **Notification**: In-app alert; included in daily report\n\n### Info Severity\n- **Response Time**: Can be batched and reviewed in daily\u002Fweekly reports\n- **Action**: Archive or group into trend analysis; no immediate action needed\n- **Handling**: Low priority; batch process for efficiency\n- **Notification**: Include in summary reports only\n\n## Output Format\n\nThe skill produces a prioritized action plan with the following structure:\n\n```\nTRIAGE REPORT: [timestamp]\nGenerated by: triage-alerts\n\nEXECUTIVE SUMMARY\n─────────────────\nTotal Alerts: [count]\nCritical: [count]  Error: [count]  Warning: [count]  Info: [count]\nOverall Risk Level: [Critical|High|Medium|Low]\n\nPRIORITY 1: CRITICAL ALERTS (Response SLA: 1 minute)\n──────────────────────────────────────────────────────\n[For each critical alert]\n  ID: [alert-id]\n  Name: [alert-name]\n  Description: [description]\n  Location: [location] (Lat: [lat], Long: [long])\n  Source: [source]\n  Created: [timestamp]\n  Recommended Action: [action]\n  Escalation Path: [team-lead] → [on-call] → [external-partner]\n  SLA Deadline: [datetime]\n\nPRIORITY 2: ERROR ALERTS (Response SLA: 15 minutes)\n────────────────────────────────────────────────────\n[For each error alert]\n  ID: [alert-id]\n  Name: [alert-name]\n  Status: [Active|Acknowledged|Resolved]\n  Assigned To: [team-member]\n  Recommended Action: [action]\n  SLA Deadline: [datetime]\n\nPRIORITY 3: WARNING ALERTS (Response SLA: 1 hour)\n──────────────────────────────────────────────────\n[Grouped by location or source]\n  Count: [number]\n  Examples: [list of alert IDs]\n  Pattern: [description of commonality]\n  Recommended Action: [action]\n\nPRIORITY 4: INFO ALERTS (Batch Processing)\n───────────────────────────────────────────\n  Count: [number]\n  Batch Processing: Daily review recommended\n  Archive Action: [Auto-archive after 30 days unless correlated]\n\nRECOMMENDATIONS\n───────────────\n1. [Action with highest impact]\n2. [Action with medium impact]\n3. [Follow-up action for trend analysis]\n\nESCALATION PATHS\n────────────────\nCritical → [Security Team Lead] → [Director] → [External SOC if required]\nError    → [Primary Responder] → [Team Lead] → [Manager if unresolved in 1 hour]\nWarning  → [Monitoring Team] → [Trend Analysis Queue]\nInfo     → [Daily Report Queue]\n```\n\n## Usage Examples\n\n### Triage recent alert logs\n```\n\u002Ftriage-alerts from recent logs\n```\n\n### Triage only critical severity alerts\n```\n\u002Ftriage-alerts Critical alerts only\n```\n\n### Triage alerts from a specific source\n```\n\u002Ftriage-alerts from Camera source\n```\n\n### Triage alerts from a geographic area\n```\n\u002Ftriage-alerts from location Building-A\n```\n\n### Triage and generate incident response plan\n```\n\u002Ftriage-alerts with incident-response-plan\n```\n\n### Triage with 2-hour SLA override (emergency response)\n```\n\u002Ftriage-alerts with emergency-sla\n```\n\n## SLA Tracking\n\nThe skill automatically:\n- Calculates time remaining until SLA deadline for each priority level\n- Flags alerts that have exceeded SLA thresholds\n- Suggests escalation when SLA is breached\n- Generates compliance reports for audit purposes\n\n## Integration Points\n\n- **Alert Management System**: Reads from alert database\n- **Incident Response System**: Triggers incident workflows for Critical alerts\n- **Notification System**: Sends appropriate notifications per SLA\n- **Reporting System**: Generates historical triage reports\n- **Team Communication**: Posts summaries to Slack\u002FTeams channels\n","# Triage Alerts Skill\n\n## When to Use\n\nUse `\u002Ftriage-alerts` when you need to:\n- Process a large batch of incoming alerts and determine response priority\n- Create an incident response checklist with SLA-driven deadlines\n- Distribute alerts across team members based on severity and availability\n- Track escalation paths for critical events\n- Organize alert response workload by urgency and impact\n\nThis skill is especially useful during security incidents, monitoring system maintenance, or routine alert reviews.\n\n## Triage Rules\n\nThe skill applies strict SLA-based triage rules to classify alerts into action buckets:\n\n### Critical Severity\n- **Response Time**: Must be triaged and acknowledged within **1 minute**\n- **Action**: Immediate escalation to security team lead and on-call personnel\n- **Handling**: Drop everything and respond; activate incident response protocols\n- **Notification**: Page + Email + SMS to escalation list\n\n### Error Severity\n- **Response Time**: Must be reviewed and acknowledged within **15 minutes**\n- **Action**: Assign to primary responder; investigate root cause\n- **Handling**: High priority; address before routine work\n- **Notification**: Email + In-app alert to assigned team\n\n### Warning Severity\n- **Response Time**: Must be processed within **1 hour**\n- **Action**: Log for trend analysis; investigate if correlated with other alerts\n- **Handling**: Normal priority; part of standard monitoring workflow\n- **Notification**: In-app alert; included in daily report\n\n### Info Severity\n- **Response Time**: Can be batched and reviewed in daily\u002Fweekly reports\n- **Action**: Archive or group into trend analysis; no immediate action needed\n- **Handling**: Low priority; batch process for efficiency\n- **Notification**: Include in summary reports only\n\n## Output Format\n\nThe skill produces a prioritized action plan with the following structure:\n\n```\nTRIAGE REPORT: [timestamp]\nGenerated by: triage-alerts\n\nEXECUTIVE SUMMARY\n─────────────────\nTotal Alerts: [count]\nCritical: [count]  Error: [count]  Warning: [count]  Info: [count]\nOverall Risk Level: [Critical|High|Medium|Low]\n\nPRIORITY 1: CRITICAL ALERTS (Response SLA: 1 minute)\n──────────────────────────────────────────────────────\n[For each critical alert]\n  ID: [alert-id]\n  Name: [alert-name]\n  Description: [description]\n  Location: [location] (Lat: [lat], Long: [long])\n  Source: [source]\n  Created: [timestamp]\n  Recommended Action: [action]\n  Escalation Path: [team-lead] → [on-call] → [external-partner]\n  SLA Deadline: [datetime]\n\nPRIORITY 2: ERROR ALERTS (Response SLA: 15 minutes)\n────────────────────────────────────────────────────\n[For each error alert]\n  ID: [alert-id]\n  Name: [alert-name]\n  Status: [Active|Acknowledged|Resolved]\n  Assigned To: [team-member]\n  Recommended Action: [action]\n  SLA Deadline: [datetime]\n\nPRIORITY 3: WARNING ALERTS (Response SLA: 1 hour)\n──────────────────────────────────────────────────\n[Grouped by location or source]\n  Count: [number]\n  Examples: [list of alert IDs]\n  Pattern: [description of commonality]\n  Recommended Action: [action]\n\nPRIORITY 4: INFO ALERTS (Batch Processing)\n───────────────────────────────────────────\n  Count: [number]\n  Batch Processing: Daily review recommended\n  Archive Action: [Auto-archive after 30 days unless correlated]\n\nRECOMMENDATIONS\n───────────────\n1. [Action with highest impact]\n2. [Action with medium impact]\n3. [Follow-up action for trend analysis]\n\nESCALATION PATHS\n────────────────\nCritical → [Security Team Lead] → [Director] → [External SOC if required]\nError    → [Primary Responder] → [Team Lead] → [Manager if unresolved in 1 hour]\nWarning  → [Monitoring Team] → [Trend Analysis Queue]\nInfo     → [Daily Report Queue]\n```\n\n## Usage Examples\n\n### Triage recent alert logs\n```\n\u002Ftriage-alerts from recent logs\n```\n\n### Triage only critical severity alerts\n```\n\u002Ftriage-alerts Critical alerts only\n```\n\n### Triage alerts from a specific source\n```\n\u002Ftriage-alerts from Camera source\n```\n\n### Triage alerts from a geographic area\n```\n\u002Ftriage-alerts from location Building-A\n```\n\n### Triage and generate incident response plan\n```\n\u002Ftriage-alerts with incident-response-plan\n```\n\n### Triage with 2-hour SLA override (emergency response)\n```\n\u002Ftriage-alerts with emergency-sla\n```\n\n## SLA Tracking\n\nThe skill automatically:\n- Calculates time remaining until SLA deadline for each priority level\n- Flags alerts that have exceeded SLA thresholds\n- Suggests escalation when SLA is breached\n- Generates compliance reports for audit purposes\n\n## Integration Points\n\n- **Alert Management System**: Reads from alert database\n- **Incident Response System**: Triggers incident workflows for Critical alerts\n- **Notification System**: Sends appropriate notifications per SLA\n- **Reporting System**: Generates historical triage reports\n- **Team Communication**: Posts summaries to Slack\u002FTeams channels\n",{"name":5,"description":7,"argument-hint":26},"[alert-data-source]","main","84ae78c1ae20bc8942c3cf83d4442c5c43953b0a","plugins\u002Falert-toolkit\u002Fskills\u002Ftriage-alerts",17,"https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FGHCP-Lab","https:\u002F\u002Fgithub.com\u002Fmicrosoft","https:\u002F\u002Fopensource.microsoft.com","Open source projects and samples from Microsoft","2026-03-31 02:49:52",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add microsoft\u002FGHCP-Lab --skill triage-alerts",{"tool":42,"command":43},"bunx","bunx skills add microsoft\u002FGHCP-Lab --skill triage-alerts",{"tool":45,"command":46},"pnpm","pnpm dlx skills add microsoft\u002FGHCP-Lab --skill triage-alerts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FGHCP-Lab\u002Fblob\u002Fmain\u002Fplugins\u002Falert-toolkit\u002Fskills\u002Ftriage-alerts\u002FSKILL.md",true,[],[51,62,78,89],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":21},"01M69BD37KF88AGCDYKG2DP4JJ","practice-exercise","Generates a hands-on practice exercise for a specified GitHub Copilot feature.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FGHCP-Lab\u002Fblob\u002Fmain\u002Fplugins\u002Flearning-companion\u002Fskills\u002Fpractice-exercise\u002FSKILL.md",[],[58,59,60,61],"practice exercise","github","github copilot","copilot",{"skillNo":63,"name":64,"nameZh":6,"description":65,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":73,"publishedAt":21},"01M69BD0XPS0ASCYD9QK5715R1","review-checklist","Generates a language-specific code review checklist tailored to the files being changed.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FGHCP-Lab\u002Fblob\u002Fmain\u002Fplugins\u002Fcode-reviewer\u002Fskills\u002Freview-checklist\u002FSKILL.md",[68],{"categoryNo":69,"categoryName":70,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",[74,75,76,77],"review","review checklist","code review","code",{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":87,"publishedAt":21},"01M69BCWTPEKNN6HWT7PQ1B0X4","my-skill","\u003CTODO: Describe what this skill does and when to use it.>","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FGHCP-Lab\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fmy-skill\u002FSKILL.md",[84],{"categoryNo":85,"categoryName":86,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000023","Skill与智能体开发",[88],"my skill",{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":98,"publishedAt":21},"01M69BCTG1689CHYJFXNKWW9EJ","generate-alerts","Generates randomized alert test data for the alert management system. Use this when asked to create sample alerts, mock data, or populate the system with test events for development and testing.","https:\u002F\u002Fgithub.com\u002Fmicrosoft\u002FGHCP-Lab\u002Fblob\u002Fmain\u002F.github\u002Fskills\u002Fgenerate-alerts\u002FSKILL.md",[95],{"categoryNo":96,"categoryName":97,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000008","测试与质量",[99,100,101,102,103,104],"generate","generate alerts","testing","test","development","create"]