MCPInstall

cx-cases

by coralogix

Triage and manage Coralogix Cases with the cx cases CLI — e.g. acknowledge, assign, resolve, or re-prioritize a case, or inspect its event timeline or notification deliveries.

Installs
3K
Last 24h
+77
Trending rank
#2365
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/coralogix/cx-cli --skill cx-cases
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads cx-cases automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Cases Management Skill

A Case groups related alert events into one investigation unit with a status, priority, category, and assignee. Use this skill to inspect cases and drive them through their lifecycle (active → acknowledged → resolved → closed).

CLI Commands

CommandPurpose
cx cases get <id>Get a single case by ID
cx cases update <id> [--title] [--resolution-reason]Update mutable fields
cx cases comment <id> --text <text>Add a comment to the case timeline
cx cases assign <id> --user <email>Assign a case (email, or raw user ID)
cx cases unassign <id>Remove the assignee
cx cases acknowledge <id>Acknowledge (signals you're working it; stops re-notification)
cx cases unacknowledge <id>Remove the acknowledgment
cx cases resolve <id> --reason <text>Resolve a case (irreversible — see below)
cx cases close <id>Close a case (terminal)
cx cases set-priority <id> --priority <P1..P5>Override the computed priority
cx cases clear-priority <id>Remove a priority override
cx cases events list <case-id>Event timeline (status changes, comments, assignments)
cx cases events get <event-id>A single event — drill in, e.g. to expand a comment thread
cx cases notifications <case-id> [<case-id> ...]Notification deliveries (connector, status, time)

Case Lifecycle

PENDING_ACTIVATION ──► ACTIVE ◄────────► ACKNOWLEDGED
                         │ ╲                │ ╲
                         │  ╲               │  ╲
                         ▼   ╲              ▼   ╲
                      CLOSED  ╲──► RESOLVED ◄─── (from ACK)
                                       │
                                       ▼
                                    CLOSED  (terminal)
From stateAllowed transitionsNotes
PENDING_ACTIVATION→ ACTIVESystem-driven activation; not user-controllable
ACTIVE→ ACKNOWLEDGED, RESOLVED, CLOSEDAck is optional; for a false alarm, close directly (skip resolve)
ACKNOWLEDGED→ ACTIVE, RESOLVED, CLOSEDThe only "back" transition: unacknowledge returns it to ACTIVE
RESOLVED→ CLOSED onlyIrreversible — cannot reopen to ACTIVE/ACKNOWLEDGED
CLOSED(none)Terminal

Categories: AVAILABILITY or SECURITY. Priorities: P1 (highest) → P5.

Triage Workflow

  1. Inspect — cx cases get <id>. The payload includes groupings, labels, impactedEntities, kpiBreaches, aiSummary, and both priorityDetails.system (computed) and priorityDetails.override (user-set).
  2. Investigate — Pull the underlying telemetry by querying the alert's DataPrime / PromQL to find root cause before acting. Optionally export the investigation via cx olly or pull the case's impactedEntities / groupings to confirm the impact. See the cx-telemetry-querying skill.
  3. Claim — cx cases assign <id> --user you@example.com then cx cases acknowledge <id>.
  4. Record findings — cx cases comment <id> --text "<note>" to leave investigation notes on the timeline (root cause, links, next steps) as you go. Comments appear as comment events in cx cases events list.
  5. Resolve or close — see below.
  6. Re-prioritize if impact differs from the computed value — cx cases set-priority <id> --priority P1 / clear-priority. Only possible while the case is still open; priority cannot be overridden once a case is RESOLVED or CLOSED.

Resolving

Resolution is irreversible (a RESOLVED case can only move to CLOSED), so the CLI requires both a reason and a confirmation:

  • Pass --reason "<text>" — a one-line postmortem (root cause, what fixed it, follow-up) visible to teammates in the timeline. Use --no-reason only when a reason genuinely doesn't apply.
  • In agent / non-interactive mode, also pass --yes; without it the command refuses and must be handed to the user to run interactively.

If uncertain, stay in ACKNOWLEDGED (reversible via unacknowledge) until confident. For non-resolution edits (title, post-hoc postmortem link), use cx cases update.

Bulk Operations

There are no bulk endpoints. To act on many cases, pipe IDs through a loop, e.g. ... | jq -r '.[].id' | xargs -I {} cx cases acknowledge {}.

Key Principles

  • Use emails, never user IDs — for assign --user and in all output.
  • resolve is irreversible and close is terminal — confirm before resolving; for false alarms close from ACTIVE directly.
  • Always supply a resolution reason unless --no-reason truly applies.
  • P1-style shorthand is accepted anywhere a priority/status/category is expected.
  • Multi-profile fan-out with -p <profile> (repeatable) for cross-environment triage.
  • Link to a specific case — build <base>/cases?id=<case_id>, where <base> is the console URL already seen in a `View in Coralogix: <base>/...` line printed by any `cx cases` command this session — never fabricate `<base>` yourself.

References

  • Case analytics: references/case-analytics.md
  • Single case investigation: references/single-case.md

Related Skills

  • cx-alerts — the alert definitions behind the events grouped into a case.
  • cx-slos — the SLO definitions whose breaches drive reliability cases.
  • cx-telemetry-querying — pivot from a case's impacted entities into logs/spans/metrics.

FAQ

What does the cx-cases skill do?

Triage and manage Coralogix Cases with the cx cases CLI — e.g. acknowledge, assign, resolve, or re-prioritize a case, or inspect its event timeline or notification deliveries.

How do I install cx-cases?

Run npx skills add https://github.com/coralogix/cx-cli --skill cx-cases in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/cx-cases/ (personal) or .claude/skills/cx-cases/ (project).

Which AI agents can use cx-cases?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is cx-cases safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains cx-cases?

It is published by coralogix in coralogix/cx-cli. It has 3,011 recorded installs.

More from coralogix/cx-cli

View all →

cx-telemetry-querying

coralogix/cx-cli

Use this skill for any question involving telemetry data: "investigate an issue", "debug a problem", "find out why something is slow", "check error rates", "analyze user behavior", "understand a production incident", "query telemetry data", "look at logs", "search logs", "find errors", "find stack traces", "filter by severity", "check traces", "examine spans", "investigate request latency", "debug service-to-service calls", "look up a trace ID", "analyze RUM data", "query rum.events", "check frontend performance", "frontend errors", "Core Web Vitals", "JavaScript exceptions", "query metrics", "check CPU usage", "run a PromQL query", "check error rate", "look up a metric", "check memory usage", "how do I write a DataPrime query", "DataPrime syntax", or wants to answer questions using observability data from logs, metrics, traces, RUM, or APM.

Code Quality & Workflow4.8K installs

cx-search-dashboard

coralogix/cx-cli

This skill should be used when the user asks to "find a dashboard", "search dashboards", "does a dashboard exist for X", "find widgets that query Y", "which dashboards use this field", "find a dashboard about errors", "look up dashboards by description", "search for existing monitoring dashboards", "find widgets that reference a field", or wants to discover existing Coralogix dashboards or widgets using natural-language or field-based search.

Data & Databases3.9K installs

coralogix-docs

coralogix/cx-cli

Search and read official Coralogix platform documentation using cx docs search and cx docs fetch. Use when the user asks how Coralogix features work, how to configure or use the UI, set up integrations (OpenTelemetry, agents, collectors, webhooks), manage API keys, explore spans/traces/logs in the product, configure alerts/SLOs/dashboards, or needs authoritative product docs — not live tenant telemetry.

Docs & Writing3.8K installs

cx-alerts

coralogix/cx-cli

This skill should be used when the user asks to "manage alerts", "create alert", "list alerts", "delete alert", "check alert status", "enable alert", "disable alert", "investigate firing alerts", "check which alerts are active", "find alerting rules", "set up an alert", "configure alerting", "mute an alert", "silence an alert", "see alert definitions", "check alert priority", or wants to manage Coralogix alert definitions using the cx CLI.

3.6K installs

cx-cli

coralogix/cx-cli

This skill should be used whenever the user runs any cx command, uses the cx CLI, Coralogix CLI, or mentions cx in the context of Coralogix observability. This skill provides cross-cutting concerns like update notifications that apply to all cx commands.

DevOps & Cloud3.6K installs

cx-observability-setup

coralogix/cx-cli

Use this skill when the user asks to "set up monitoring", "configure observability", "onboard new service", "create saved view", "set up notifications", "configure webhook", "set up Slack integration", "outgoing webhook", "automation action", "webhook for alerts", "create view", "saved view", "view folder", "organize dashboards", "install integration", "configure extension", "contextual data", "connect external service", "create notification connector", "set up email alerts", "configure PagerDuty", "notification routing", "deploy extension", "test webhook", "notification preset", "test notification", "webhook actions", or wants to set up, configure, or manage the observability stack for a service or team.

DevOps & Cloud3.5K installs

Popular other skills

View category →

hyperframes-cli

heygen-com/hyperframes

The HyperFrames CLI by job - scaffold, check, look at frames, edit the timeline, preview, render locally or in the cloud, publish, project history - plus reading its JSON and recovering from build or render failures.

1.3M installs

triage

mattpocock/skills

Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.

1M installs

ask-matt

mattpocock/skills

Ask which skill or flow fits your situation. A router over the skills in this repo.

778.4K installs

to-questionnaire

mattpocock/skills

Turn a decision you can't fully answer into a questionnaire for someone else to fill in.

508.9K installs

wait-what

mattpocock/skills

Stop. That last message did not land: re-pitch it.

459.7K installs

loop-me

mattpocock/skills

Grill me about specs for the workflows I want to build, within this workspace.

447.9K installs