zdx-investigate-alerts
Investigate active and historical ZDX alerts to understand their scope, root cause, and impact. Drills into affected devices, correlates with application metrics, and identifies patterns across time. Aligned with ZDX Copilot troubleshooting use cases. Use when an administrator asks: 'Show me ongoing alerts', 'What incidents happened in the last 48 hours?', 'How many users are affected by this alert?', or 'Is there an ISP issue?'
What this skill does
# ZDX: Investigate Alerts
## Keywords
alerts, incidents, zdx alerts, active alerts, historical alerts, affected devices, alert investigation, ongoing alert, ISP issue, blackout, degradation, alert scope, impacted users, alert history
## Overview
Investigate active and historical ZDX alerts to determine their scope, affected users, root cause, and whether they represent isolated incidents or broader patterns. This skill provides a systematic approach to alert triage and investigation.
**Use this skill when:** An administrator wants to review current or past alerts, understand alert impact, investigate ISP or network incidents, or determine if a reported issue correlates with a known alert.
**ZDX Copilot alignment:** This skill covers the Troubleshooting category -- "Show me the number of ongoing alerts", "Show me the Incidents in the last 48 hours", "What can I do when I see a blackout incident with an ISP?"
---
## Data Presentation Requirements
**All tables are rendered by the HTML template, not by hand.** Do not author `<table>`, `<thead>`, `<tbody>`, `<tr>`, `<th>`, or `<td>` markup in your reply or in the report. You produce a JSON payload (see *Data Payload Contract*) and the template at `./templates/report.html.template` turns it into the styled, sortable, exportable tables shown in `./example/report.example.html`.
After each table, provide:
1. **Detailed analysis** explaining the alert severity, scope, and correlation between alerts
2. **Root cause identification** based on metric correlation and affected scope
3. **Next steps / resolution** with specific remediation actions, escalation paths, and monitoring recommendations
Use color-coded rows by alert priority:
- Red: High priority alerts (many affected devices, critical applications, long duration)
- Yellow: Medium priority alerts (moderate impact, localized scope)
- Green: Low priority or resolved alerts
## ⚠ HTML OUTPUT — READ THIS BEFORE PRODUCING ANY HTML
There is exactly one acceptable way to produce the HTML output:
1. **Read the template from disk** — do NOT inline a copy in your response. The template lives next to this SKILL.md inside the skill's package, at:
```text
./templates/report.html.template
```
The `./` prefix is intentional: this path is **relative to the skill folder** (the directory containing this SKILL.md), **never** an absolute path. Most agents that load skills from an uploaded `.zip` extract the package into a working directory and expose its contents via that relative path — read the file by joining the skill's own root directory with `./templates/report.html.template`. Do not rewrite this to an absolute path that points at the author's machine.
2. **Build a single JSON object** (`__ZDX_DATA__` payload) shaped exactly as documented in the *Data Payload Contract* section below. Aggregate the responses from the ZDX MCP tool calls (Steps 1–6 of the *Workflow*) into that object.
3. **Replace** the literal token `__ZDX_DATA__` (which appears once, inside `<script type="application/json" id="zdx-data">__ZDX_DATA__</script>`) with the JSON object. Do not edit any other part of the template.
4. **Write** the result to disk as `alert_investigation_report_<YYYYMMDD-HHMMSS>.html` next to the .docx, and give the user a `computer://` link to it.
This template already provides: Zscaler header with logo · sticky top bar · scope summary bar · KPI cards with severity-coded top borders · per-table search + filter chips · sortable color-coded tables · per-table CSV export · light/dark theme toggle · top-right language dropdown (EN / ES / PT / FR / JA) · printable PDF view · localStorage prefs · Analysis / Root Cause / Remediation block.
**If you find yourself writing `<html>`, `<style>`, or `<table>` in a code-block destined for the user, stop. Read the template instead.**
A populated reference rendering ships with this skill at `./example/report.example.html` (relative to the skill folder). Open it in a browser to preview the exact layout and depth expected.
### Data Payload Contract
The full `__ZDX_DATA__` payload is one JSON object. Every field below is **required** unless marked optional. This skill emits **two tables**: the active alert summary and the per-alert metric correlation.
```json
{
"generated_at": "<ISO 8601 timestamp>",
"scope_en": "Free-form description in English",
"scope_es": "...in Spanish (optional, falls back to scope_en)",
"scope_pt": "...in Portuguese (optional)",
"scope_fr": "...in French (optional)",
"scope_ja": "...in Japanese (optional)",
"kpis": {
"total": "<int>",
"high": "<int>",
"medium": "<int>",
"low": "<int>",
"mostAffectedApp": "<app name or '—'>",
"impactedDevices": "<int>"
},
"tables": {
"alerts": [
{
"severity": "critical | warning | good",
"priority": "High | Medium | Low",
"name": "<alert title>",
"application": "<app name>",
"duration": "<e.g. '6 hours'>",
"affectedDevices": "<int>",
"locations": "<comma-separated location names>",
"bottleneck": "<e.g. 'PFT: 12.4s'>",
"status": "Active | Resolved"
}
],
"correlation": [
{
"severity": "critical | warning | good",
"alert": "<alert title>",
"pft": "<value or '—'>",
"dns": "<value or '—'>",
"availability": "<value or '—'>",
"rootCauseIndicator": "Server-side / CDN | Local DNS resolver | Application server instability | ISP path | …"
}
]
},
"analysis": {
"summary": "...",
"rootCause": "...",
"remediation": [
{ "priority": "Immediate | Investigate | Monitor | Communicate", "action": "..." }
]
}
}
```
Map each row's `severity` from `priority`: `High` → `critical`, `Medium` → `warning`, `Low` → `good`.
## Output Artifacts — MANDATORY
You MUST generate BOTH files below. Both are REQUIRED output for every alert investigation.
### 1. Word Document (.docx) — REQUIRED
Write a Word document to disk named `alert_investigation_report_<YYYYMMDD-HHMMSS>.docx` containing:
- Executive summary with active alert count, severity breakdown, and scope
- Active alerts table (priority, alert name, application, duration, affected devices, locations, bottleneck)
- Metric correlation per alert (PFT, DNS, availability, root cause indicator)
- Historical pattern analysis (recurring alerts, frequency, time patterns)
- Per-alert root cause analysis with supporting evidence
- Prioritized remediation actions and escalation paths
### 2. Interactive HTML Web Page (.html) — REQUIRED
Generated by the template-substitution flow described in the **HTML OUTPUT** section above. Filename: `alert_investigation_report_<YYYYMMDD-HHMMSS>.html`. Do not hand-author HTML or CSS — the template ships everything the report needs.
---
## Workflow
### Step 1: List Active Alerts
Retrieve all currently active alerts.
```text
zdx_list_alerts()
```text
For a broader time window (e.g., last 48 hours):
```text
zdx_list_alerts(since=48)
```text
Filter by location or department for scoped investigation:
```text
zdx_list_alerts(
location_id=["<location_id>"],
since=24
)
```text
```text
zdx_list_alerts(
department_id=["<department_id>"],
since=24
)
```text
**Triage by severity and scope:**
- How many alerts are active?
- Which applications are affected?
- How long have they been active?
- Are multiple alerts pointing to the same root cause?
---
### Step 2: Get Alert Details
For each alert that warrants investigation:
```text
zdx_get_alert(alert_id="<alert_id>")
```text
**Key information to extract:**
- Alert type (performance degradation, availability, etc.)
- Triggered application and threshold
- Impacted departments and locations
- Geolocation data
- Alert trigger conditions
- Start time and duration
---
### Step 3: Determine Impact Scope
List all devices affected by the alert:
```text
zdx_list_alert_affected_devices(alert_id="<alert_id>")
```text
FiltRelated in General
modeling-omnistudio-epc-catalog
IncludedSalesforce Industries CME EPC product-modeling skill for Product2-based catalog creation. Use when creating EPC products, configuring product attributes, building offer bundles with Product Child Items, or reviewing EPC DataPack JSON metadata for product catalog changes. TRIGGER when: user creates or updates Product2 EPC records, AttributeAssignment payloads, AttributeMetadata/AttributeDefaultValues, Offer bundles, or ProductChildItem relationships. DO NOT TRIGGER when: designing OmniScripts/FlexCards/Integration Procedures (use building-omnistudio-omniscript, building-omnistudio-flexcard, or building-omnistudio-integration-procedure), implementing Apex business logic (use generating-apex), or troubleshooting deployment pipelines (use deploying-metadata).
relationship-science-coach
IncludedUse this skill for direct, practical adult relationship coaching: couples conflict, repair, trust, marriage, dating, flirting, attachment patterns, emotional connection, sex, desire differences, eroticism, kink negotiation, affection, love languages, breakups, and long-term passion. Draw on Gottman, EFT and Hold Me Tight, attachment science, modern sex research, Perel, Nagoski, Kerner, Schnarch, Love and Stosny, and flexible love-language tools. Be concrete and low-hedge. Redirect only for imminent danger, abuse, coercive control, minors, non-consent, self-harm, stalking, or medical/legal/psychiatric decisions.
building-sf-integrations
IncludedSalesforce integration architecture and runtime plumbing with 120-point scoring. Use this skill to set up Named Credentials, External Credentials, External Services, REST/SOAP callout patterns, Platform Events, and Change Data Capture. TRIGGER when: user sets up Named Credentials, External Services, REST/SOAP callouts, Platform Events, CDC, or touches .namedCredential-meta.xml files. DO NOT TRIGGER when: Connected App/OAuth config (use configuring-connected-apps), Apex-only logic (use generating-apex), or data import/export (use handling-sf-data).
venue-templates
IncludedAccess comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.
let-fate-decide
IncludedDraws the 12 Houses of the Zodiac Tarot spread to inject entropy into planning when prompts are vague, ambiguous, or casually delegated. Interprets the spread to guide next steps. Use when the user says 'let fate decide', 'YOLO', 'whatever', 'idk', or other nonchalant phrases, makes Yu-Gi-Oh references, or when you are about to arbitrarily pick between multiple reasonable approaches. Prefer over ask-questions-if-underspecified when the user's tone is casual or playful rather than precision-seeking.
net-ops
IncludedCross-platform network troubleshooting (Windows, macOS, Linux) via local or remote shell. Use for: DNS broken, can't resolve hostnames, nslookup/dig works but apps fail, NRPT, WFP, scutil, /etc/resolver, systemd-resolved, /etc/resolv.conf, NetworkManager, VPN DNS leak residue (ProtonVPN/Mullvad/WireGuard/AnyConnect), AV/firewall blocking DNS or DoH, Tailscale DNS interaction, intermittent connectivity, remote diagnostics over SSH.