Help us improve
Share bugs, ideas, or general feedback.
From chelsea-piers-itops
Triage active alerts across systems — NinjaOne RMM, Meraki network, and Azure Monitor — correlate related alerts, assess severity, and recommend immediate actions. Use when: an alert notification arrives, during morning ops review, after a system event, or when multiple alerts fire simultaneously and you need to understand the blast radius. Activates on "alerts", "triage alerts", "check alerts", "what's firing", "alert review", "morning ops", "active incidents", "alert storm", "NinjaOne alert", "Meraki alert", "Azure alert".
npx claudepluginhub afoxnyc3/chelsea-piers-itops --plugin chelsea-piers-itopsHow this skill is triggered — by the user, by Claude, or both
Slash command
/chelsea-piers-itops:alert-triage [system: ninjaone|meraki|azure|all] [severity: critical|high|all][system: ninjaone|meraki|azure|all] [severity: critical|high|all]The summary Claude sees in its skill listing — used to decide when to auto-load this skill
> If you see unfamiliar placeholders, see [CONNECTORS.md](../../CONNECTORS.md).
Provides Playwright E2E testing patterns including Page Object Model, test organization, configuration, CI/CD integration, and flaky test strategies.
Share bugs, ideas, or general feedback.
If you see unfamiliar placeholders, see CONNECTORS.md.
Pull and correlate active alerts across all CP monitoring systems into a unified triage view.
/alert-triage $ARGUMENTS
Examples:
/alert-triage all — all systems, all severities/alert-triage critical — critical alerts only, all systems/alert-triage ninjaone — NinjaOne RMM alerts only/alert-triage azure high — Azure alerts at High severity| System | What It Monitors | Connector |
|---|---|---|
| NinjaOne | Endpoints (Windows/Mac), servers, patch state, disk/CPU/RAM | ~~rmm |
| Meraki | Network — switches, APs, MX appliances, WAN uplinks | ~~network |
| Azure Monitor | Cloud resources — VMs, App Services, databases, function apps | ~~cloud |
| NinjaOne | Meraki | Azure | Unified Severity |
|---|---|---|---|
| Critical | — | Critical (Sev 0/1) | 🔴 Critical |
| Major | Alert (uplink down) | Error (Sev 2) | 🟠 High |
| Minor | Warning | Warning (Sev 3) | 🟡 Medium |
| Informational | Info | Informational | ⚪ Low |
| Pattern | Probable Cause |
|---|---|
| MX alert + multiple AP alerts (same venue) | WAN or upstream switch failure |
| Multiple Windows endpoints: high CPU | Malware scan, patch deployment, or event |
| NinjaOne disk alert + Azure backup failure | Disk full blocking backup job |
| Azure VM unreachable + NinjaOne agent offline | VM crashed or network partition |
| Multiple devices: auth failure alerts | Entra ID outage or DC issue |
## Alert Triage — [timestamp]
**Systems queried:** [NinjaOne / Meraki / Azure / All]
**Total active alerts:** [N]
**Critical:** [N] | High: [N] | Medium: [N] | Low: [N]
---
### 🔴 Critical Alerts
#### [Alert Title / Device Name]
- **Source:** [NinjaOne / Meraki / Azure]
- **Alert:** [description]
- **Resource:** [device / resource name]
- **Since:** [time — X hours ago]
- **Probable cause:** [assessment]
- **Immediate action:** [specific step]
- **Related alerts:** [list if correlated]
- **Jira ticket:** [create one / already exists: [ticket ID]]
---
### 🟠 High Alerts
[same format, abbreviated]
---
### 🟡 Medium Alerts (summary)
| Alert | Source | Device | Since |
|-------|--------|--------|-------|
| [alert] | [source] | [device] | [time] |
---
### Correlation Groups
- **Group 1 — Venue network issue (Pier 60):** MX uplink down → 3 AP alerts → 2 NinjaOne agent offline alerts. Single root cause: WAN failure. Action: check `/sd-wan-status Pier 60`.
- **Group 2 — [description]**
### Alert Storm Assessment
[If >10 alerts: assess if this is an alert storm vs. a genuine outage. Recommend muting low-severity alerts during incident response.]
### Recommended Next Steps
1. [Priority 1 action]
2. [Priority 2 action]
3. Run `/incident-postmortem` when resolved if any Critical alert lasted >30 minutes
If ~~rmm (NinjaOne) is connected:
ninjaone_list_alerts for open alerts, filter by severityninjaone_get_deviceIf ~~network (Meraki) is connected:
meraki_get_network_alerts for each venue networkmeraki_get_uplink_status for WAN alertsIf ~~cloud (Azure) is connected:
If no connectors:
/alert-triage all each morning before 9am. Any Critical = create Jira incident ticket immediately./sla-check to monitor open ticket SLA status.