/incident-commander

name: "incident-commander"
description: "Use when declaring or running a production incident or outage, or writing its post-incident review. Classifies severity with incident_classifier.py, rebuilds the timeline with timeline_reconstructor.py and drafts the PIR with pir_generator.py. Security incidents: incident-response."

Incident Commander Skill

**Category:** Engineering Team **Tier:** POWERFUL **Author:** Claude Skills Team **Version:** 1.0.0 **Last Updated:** February 2026

Overview

Incident response framework for **availability/reliability incidents** (outages, degradations, failed deploys): severity classification, timeline reconstruction, and post-incident review.

**This is NOT security incident triage.** For security events (ransomware, intrusion, data exfiltration, IOC analysis, NIST SP 800-61 forensics), route to `incident-response`. Both skills use SEV1-SEV4 labels; this one scores operational impact (users, revenue, SLA), while `incident-response` classifies attack types and forensic handling.

Key Features

• **Automated Severity Classification** - Intelligent incident triage based on impact and urgency metrics
• **Timeline Reconstruction** - Transform scattered logs and events into coherent incident narratives
• **Post-Incident Review Generation** - Structured PIRs with multiple RCA frameworks
• **Communication Templates** - Pre-built templates for stakeholder updates and escalations
• **Runbook Integration** - Generate actionable runbooks from incident patterns

Skills Included

Core Tools

1. **Incident Classifier** (`incident_classifier.py`)

• Analyzes incident descriptions and outputs severity levels
• Recommends response teams and initial actions
• Generates communication templates based on severity

2. **Timeline Reconstructor** (`timeline_reconstructor.py`)

• Processes timestamped events from multiple sources
• Reconstructs chronological incident timeline
• Identifies gaps and provides duration analysis

3. **PIR Generator** (`pir_generator.py`)

• Creates comprehensive Post-Incident Review documents
• Applies multiple RCA frameworks (5 Whys, Fishbone, Timeline)
• Generates actionable follow-up items

Incident Response Framework

Severity Classification System

SEV1 - Critical Outage

**Definition:** Complete service failure affecting all users or critical business functions

**Characteristics:**

• Customer-facing services completely unavailable
• Data loss or corruption affecting users
• Security breaches with customer data exposure
• Revenue-generating systems down
• SLA violations with financial penalties

**Response Requirements:**

• Immediate escalation to on-call engineer
• Incident Commander assigned within 5 minutes
• Executive notification within 15 minutes
• Public status page update within 15 minutes
• War room established
• All hands on deck if needed

**Communication Frequency:** Every 15 minutes until resolution

SEV2 - Major Impact

**Definition:** Significant degradation affecting subset of users or non-critical functions

**Characteristics:**

• Partial service degradation (>25% of users affected)
• Performance issues causing user frustration
• Non-critical features unavailable
• Internal tools impacting productivity
• Data inconsistencies not affecting user experience

**Response Requirements:**

• On-call engineer response within 15 minutes
• Incident Commander assigned within 30 minutes
• Status page update within 30 minutes
• Stakeholder notification within 1 hour
• Regular team updates

**Communication Frequency:** Every 30 minutes during active response

SEV3 - Minor Impact

**Definition:** Limited impact with workarounds available

**Characteristics:**

• Single feature or component affected
• <25% of users impacted
• Workarounds available
• Performance degradation not significantly impacting UX
• Non-urgent monitoring alerts

**Response Requirements:**

• Response within 2 hours during business hours
• Next business day response acceptable outside hours
• Internal team notification
• Optional status page update

**Communication Frequency:** At key milestones only

SEV4 - Low Impact

**Definition:** Minimal impact, cosmetic issues, or planned maintenance

**Characteristics:**

• Cosmetic bugs
• Documentation issues
• Logging or monitoring gaps
• Performance issues with no user impact
• Development/test environment issues

**Response Requirements:**

• Response within 1-2 business days
• Standard ticket/issue tracking
• No special escalation required

**Communication Frequency:** Standard development cycle updates

Incident Commander Role

Primary Responsibilities

1. **Command and Control**

• Own the incident response process
• Make critical decisions about resource allocation
• Coordinate between technical teams and stakeholders
• Maintain situational awareness across all response streams

2. **Communication Hub**

• Provide regular updates to stakeholders
• Manage external communications (status pages, customer notifications)
• Facilitate effective communication between response teams
• Shield responders from external distractions

3. **Process Management**

• Ensure proper incident tracking and documentation
• Drive toward resolution while maintaining quality
• Coordinate handoffs between team members
• Plan and execute rollback strategies if needed

4. **Post-Incident Leadership**

• Ensure thorough post-incident reviews are conducted
• Drive implementation of preventive measures
• Share learnings with broader organization

Decision-Making Framework

**Emergency Decisions (SEV1/2):**

• Incident Commander has full authority
• Bias toward action over analysis
• Document decisions for later review
• Consult subject matter experts but don't get blocked

**Resource Allocation:**

• Can pull in any necessary team members
• Authority to escalate to senior leadership
• Can approve emergency spend for external resourc