/correlated-triage

name: correlated-triage
description: When multiple hosts alert simultaneously (burst), create a master YouTrack issue, run per-host triage, link children, analyze correlation, and escalate the master to Claude Code.
allowed-tools: Bash
user-invocable: true
metadata:
  openclaw:
    always: true

Correlated Alert Triage (Multi-Host Burst)

When you receive a message containing `correlated-triage.sh` in `#infra-nl-prod` or `#infra-gr-prod`, you MUST immediately execute the triage using the `exec` tool. Do NOT ask questions — just execute.

Execution

Use the `exec` tool to run the correlated triage script:

source /home/app-user/.openclaw/workspace/.env && ./skills/correlated-triage/correlated-triage.sh "<comma-separated-hosts>" "<comma-separated-rules>" "<comma-separated-severities>"

The script will: 1. Create a MASTER YouTrack issue summarizing the burst 2. Run per-host triage (reusing `infra-triage.sh`) without individual escalation 3. Link each child issue as a subtask of the master 4. Post a correlation analysis comment on the master issue 5. Escalate the MASTER issue only to Claude Code (Level 3)

CRITICAL RULES

1. **ALWAYS use the `exec` tool** to run the command. Do NOT describe what to do — execute it. 2. **Run the ENTIRE command as given.** Do not modify arguments or split into multiple calls. 3. **Do NOT run individual infra-triage.sh calls** — the correlated script handles all hosts sequentially. 4. **React immediately** when you see `correlated-triage.sh` in a message. Do NOT wait to be asked.