Incident Response
From alert to diagnosis, hands-free.
TUTOR WITH THEFOCUS.AI
Copy this prompt into Claude, ChatGPT, or any external AI assistant. It points the assistant to the course instructions and links it to your student profile to track your progress and customize observations.
You are not enrolled yet. Enroll to generate a Student ID to track lesson completions and store learning notes.
From alert to diagnosis, hands-free
The most advanced L4 pattern combines Channels and MCP into an automated incident response pipeline. Here is the full flow:
1. Alert arrives: Monitoring system sends a webhook — "QuickBooks sync failed"
2. Check connection: Claude tests the QuickBooks MCP connection — is the API responding?
3. Check recent changes: Claude reviews recent configuration changes — did someone rotate credentials?
4. Diagnose: Claude checks error logs, identifies the issue (expired OAuth token, rate limit, network timeout)
5. Notify: Claude sends a diagnostic summary via Telegram: "QuickBooks sync failed. Cause: OAuth token expired 2 hours ago. Action needed: re-authorize in QuickBooks settings."
6. Optionally remediate: If the fix is automatable (retry after rate limit, refresh token), Claude handles it and confirms
Each step uses a different MCP server or tool. The Channel provides the trigger. MCP servers provide the data. Claude provides the reasoning — not following a rigid runbook, but investigating an incident the way an experienced operator would.
“The first time the incident response pattern caught a real bug at 3am, diagnosed it, and had a PR ready by the time I woke up, I understood what L4 actually means.”
The system that works while you sleep
Step back. Look at what you have built across the last three chapters:
| Layer | What You Built | Chapter |
|---|---|---|
| Knowledge | SKILL.md — your organizational rules | Ch 04 |
| Data | MCP connection — live access to your systems | Ch 07 (this chapter) |
| Interface | Claude Code + Remote Control | Ch 06 |
| Automation | Routines + Channels | Ch 07 (this chapter) |
Knowledge plus data plus automation. Your categorization rules applied to real transactions on a schedule, with exceptions pushed to you via Telegram. That is L4 — the system surfaces insights before being asked and acts within defined boundaries.
What is ONE thing you check every morning? A dashboard, an inbox, a report, a set of numbers? Write it down. That is your next scheduled task.
Now think: what event in the outside world should Claude respond to without you asking? A new email, a failed deployment, an invoice arrival, an alert? Write that down too. That is your first channel.
You are at L4. In the next chapter, you will close the last gap — the systems and applications that have no API, no MCP server, no command line interface. The ones you can only operate by clicking.
Check your understanding
Answer in your own words — write it down before opening the key. Your tutor grades against the criteria and generates fresh variants on retries.
Q1. Design an incident-response flow for a real failure you encounter: the trigger, two diagnostic checks, the notification, and the line that separates what it may auto-remediate from what needs a human.
Answer key — attempt every question first
Answer key
Q1
Model answer: Any coherent flow passes: real trigger (alert webhook), two checks that actually discriminate causes (is the API up? did credentials change?), a notification that carries the diagnosis, and a defensible boundary — mechanical/reversible fixes (retry, token refresh) auto-remediate; anything touching money, data deletion, or ambiguity goes to a human.
Pass criteria: all four components present; auto-remediation boundary drawn at reversibility/ambiguity, not arbitrary
Next: Browser Automation