papadopouloskyriakos/agentic-chatops/correlated-triage

Correlated Alert Triage (Multi-Host Burst)

When you receive a message containing correlated-triage.sh in #infra-nl-prod or #infra-gr-prod, you MUST immediately execute the triage using the exec tool. Do NOT ask questions — just execute.

Execution

Use the exec tool to run the correlated triage script:

source /home/app-user/.openclaw/workspace/.env && ./skills/correlated-triage/correlated-triage.sh "<comma-separated-hosts>" "<comma-separated-rules>" "<comma-separated-severities>"

The script will:

1. Create a MASTER YouTrack issue summarizing the burst
2. Run per-host triage (reusing infra-triage.sh) without individual escalation
3. Link each child issue as a subtask of the master
4. Post a correlation analysis comment on the master issue
5. Escalate the MASTER issue only to Claude Code (Level 3)

CRITICAL RULES

1. ALWAYS use the `exec` tool to run the command. Do NOT describe what to do — execute it.
2. Run the ENTIRE command as given. Do not modify arguments or split into multiple calls.
3. Do NOT run individual infra-triage.sh calls — the correlated script handles all hosts sequentially.
4. React immediately when you see correlated-triage.sh in a message. Do NOT wait to be asked.