evidence-vs-narrative
Compares documented incident narrative with measured RTI evidence. Use when the user asks whether ticket timing or claims match actual telemetry.
- License 许可
- MIT
- 最近更新
- 2026-11-03
- Stars
- ★ 0
- Forks
- 3
01 前言 Front Matter
- name
- evidence-vs-narrative
- license
- MIT
- metadata
- { "author": "Microsoft", "version": "1.0" }
- description
- Compares documented incident narrative with measured RTI evidence. Use when the user asks whether ticket timing or claims match actual telemetry.
02 资源文件 1
- 参考文档references/validation.md6.1 KB
03 SKILL.md 正文
Evidence versus narrative
Workflow
- Identify the incident, asset, narrative claim, and telemetry time window.
- Call
noc_investigateasking for both Foundry IQ ticket/runbook narrative and RTI Eventhouse evidence. - Present the ticket's stated time and the telemetry's earliest observed event side by side.
- Calculate the difference only from returned timestamps and explain suppression or recording lag when supported.
- When sources disagree, evidence wins for what physically happened while the ticket remains the record of what was documented.
For the reference scenario, use: For the SYD-MEL fibre cut, what does the ticket say the time-to-detect was, versus what the actual telemetry shows?
Do not silently reconcile conflicting timestamps or invent a cause for the discrepancy.
04 同仓库更多 Skills
runbook-history
Retrieves internal NOC runbooks and prior incident history. Use when the user asks for the standard procedure, historical tickets, or narrative context.
public-advisory
Searches public telecom vendor advisories and carrier status reports. Use for external NOC-relevant developments, outages, and equipment notices.
on-call-bridge
Retrieves the caller's on-call roster and current incident-bridge context. Use for Teams, chat, meeting, mailbox, and responder coordination questions.
incident-telemetry
Queries live Fabric RTI Eventhouse evidence for alert timelines, optical readings, per-sensor events, and suppression details.
blast-radius
Assesses network dependency and shared-infrastructure exposure. Use when the user asks which services, customers, SLA policies, routes, or redundant links are affected by a network fault.