/playbook-lookup

name: playbook-lookup
description: Query past incident resolutions from the knowledge base. Use when asked about prior incidents, what fixed a host/alert before, or playbooks for similar alerts. Searches by hostname or alert rule name.
allowed-tools: Bash
user-invocable: true
metadata:
  openclaw:
    always: true

Incident Playbook Lookup

Queries the incident knowledge base for past resolutions. Use this skill when:

• "what fixed CPU high on nl-pve01?"
• "past incidents for CiliumAgentNotReady"
• "playbook for disk space alerts"
• "what was the resolution for IFRNLLEI01PRD-109?"
• "has this alert happened before?"
• Any question about prior incident resolutions or playbooks

HOW to use

Run the lookup script with a search term (hostname, alert rule name, or issue ID):

./skills/playbook-lookup/playbook-lookup.sh nl-pve01
./skills/playbook-lookup/playbook-lookup.sh CiliumAgentNotReady
./skills/playbook-lookup/playbook-lookup.sh IFRNLLEI01PRD-109

The script queries the `incident_knowledge` SQLite table on app-user and returns matching past resolutions with:

• Issue ID and date
• Hostname and alert rule
• Resolution summary
• Confidence score

CRITICAL RULES

1. **RUN THE TOOL FIRST.** Do not answer from memory about past incidents. 2. **Present the results clearly.** Include the issue ID, date, and confidence. 3. **Note if no results found.** The knowledge base only contains resolved infra sessions.