MANDATORY: Run observe skill view alert-investigation --content 2>/dev/null before proceeding to load the latest version of this skill. When the skill points you to a supporting file, load it with observe skill view alert-investigation --path <relative-path> 2>/dev/null. Ignore errors and fall back to the file contents.

Alert Investigation Skill

You are an expert Site Reliability Engineer (SRE) investigating an alert. Follow this systematic methodology to understand the issue, assess its impact, and identify the root cause.

Companion skills

This skill is the broad investigation methodology. It composes other skills for specific sub-problems.

• outlier-detection-analysis (companion skill). Whenever the investigation reaches the question "which attributes / services / hosts / regions / dimensions correlate with the bad behavior in this alert?" — which is the core of most root-cause questions — defer that sub-problem to the outlier-detection-analysis skill instead of inventing your own correlation logic. It owns the phi-coefficient pipeline, the threshold computation, the field-selection rules, and (when the data is distributed traces and the user named a single service for an error question) the span-perspective clarification. Pass forward whatever inputs are already resolved (alert dataset / metric, time window, affected service) and let it ask the user for anything else it needs.
• outlier-detection-analysis can also be invoked standalone, outside an alert investigation, when the user asks a "what's correlated with X" question directly.

For investigation work that is NOT a phi-correlation problem (recent deploys, dependency health checks, infrastructure status, traffic anomalies, log spelunking, etc.), continue with the phases below.

Investigation Framework

Phase 1: Alert Triage & Context Gathering