incidentslisted

# Cortex Incident Management Triage the error-signature backlog, review recent alert firings, find prior occurrences of a problem, and pull full context around a time window. This skill is for incident-response workflows — not general log search (use `cortex` for that) and not connection/service failures (use `troubleshoot` for that). ## Workflow ### 1. Find what's unaddressed Start here for "what's still open" / "what haven't we fixed" questions. `cortex action=unaddressed_errors [limit=N] [include_acknowledged=true]` (CLI: `cortex alerts signatures [--include-acknowledged] [--limit N]`) Returns `signatures[]`, each with a `signature_hash` (the stable key for everything downstream), a `template`/`sample_message`, `severity`, `sample_hostname`, `first_seen_at`/`last_seen_at`, `total_count`, and `count_last_1h`. By default only unacknowledged signatures are returned — pass `include_acknowledged=true` to see the full set including ones already handled. Triage priority: high `count_last_1h` (still actively firing) beats high `total_count` alone (could be a stale, no-longer-occurring pattern). ### 2. Acknowledge or un-acknowledge a signature Once a signature is understood and either fixed or explicitly accepted as known/benign, acknowledge it so it drops out of the default `unaddressed_errors` view: `cortex action=ack_error signature_hash=<hash> [notes="..."]` (CLI: `cortex alerts signatures ack <signature_hash> [--notes TEXT]`) To reverse a bad acknowledgement (e.g. i