Monitoring & Observability Agent Skills

Automate Better Stack monitoring operations using Composio's toolkit via Rube MCP, with dynamic tool discovery and connection management.

Automate SSL certificate monitoring and analysis using the Sslmate Cert Spotter API through Rube MCP and Composio.

Discover and inventory undocumented API endpoints by comparing live traffic against OpenAPI specs, scanning code repositories, and analyzing cloud configurations.

Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection, triggering alerts via email, Slack, or syslog when decoy files are accessed.

Analyze WAF logs from ModSecurity, AWS WAF, or Cloudflare to detect SQL injection attack campaigns, classify injection types, and generate incident reports with OWASP classification.

Analyze AWS CloudTrail logs for security monitoring, threat detection, and forensic investigation using Athena, CloudWatch Logs Insights, and SIEM integration.

Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT/OT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.

Analyze network traffic, logs, and data flows to detect potential data exfiltration via DNS tunneling, cloud storage uploads, encrypted channels, and other indicators of compromise.

Configure Fluentd and Fluent Bit for centralized log aggregation, routing, filtering, and enrichment across distributed infrastructure.

Validate backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to ensure backups are reliable for disaster recovery and ransomware response scenarios.

Deploys Datadog Cloud SIEM, CSM, and Workload Protection to detect threats, enforce compliance, and respond to security events across cloud and hybrid infrastructure.

Detect network reconnaissance and port scanning using Suricata and Snort IDS signatures, threshold-based detection rules, and traffic anomaly analysis to identify Nmap, Masscan, and custom scanning activity.

Build automated alerting for vulnerability remediation SLA breaches with severity-based timelines, escalation workflows, and compliance reporting dashboards.

Configures Windows Advanced Audit Policy, event log sizes, and Windows Event Forwarding to generate high-fidelity security events for threat detection and SIEM ingestion.

Configure rsyslog for centralized log collection with TLS encryption, custom templates, and log rotation. Generates server and client configuration files with GnuTLS stream drivers, x509 certificate authentication, per-host log segregation, and reliable queue settings for high-availability syslog infrastructure.

Deploy Nozomi Networks Guardian sensors for passive OT network traffic analysis to achieve asset visibility, threat detection, and vulnerability assessment across industrial control systems.

Design, deploy, and operate production-ready software with stability patterns, capacity planning, and zero-downtime releases.

Optimize web performance by applying browser networking, protocol, and rendering principles to reduce latency and improve Core Web Vitals.

Query and filter Datadog logs from the shell using the Composio CLI, enabling scoped log searches, pivoting across services and environments, and exporting structured JSON for downstream analysis.

Diagnose Sentry issues without copy-pasting stack traces. Uses the Composio CLI to pull issue details, events, breadcrumbs, and suspect commits, then maps the frames to local source so the agent can propose a fix directly.

Designs chaos experiments, creates failure injection frameworks, and facilitates game day exercises for distributed systems — producing runbooks, experiment manifests, rollback procedures, and post-mortem templates.

Configures monitoring systems, implements structured logging pipelines, creates Prometheus/Grafana dashboards, defines alerting rules, and instruments distributed tracing.

Trace, evaluate, and monitor LLM applications with an open-source observability platform.

Debug, evaluate, and monitor LLM applications with tracing, datasets, and built-in evaluators.

Provides strategic and operational guidance on ITIL 4 and ITIL 5 frameworks, focusing on AI governance, sustainability, and product-centric lifecycle management.

Diagnose and fix Core Web Vitals issues on AEM Edge Delivery Services pages using EDS-specific domain knowledge, including the 100KB LCP budget, E-L-D loading phases, block rendering behavior, and third-party script impact. Produces specific fixes for LCP, CLS, and INP with before/after projections.

Generates a single-page engineering runbook template with service overview, alerts table, dashboards, common procedures, on-call rotation, and incident response checklist.

Set up GPU profiling, tracing, and monitoring for inference workloads using vLLM, SGLang, PyTorch, and dstack services via the Graphsignal Profiler sidecar.

Provides a CTO-level framework for architecting, auditing, and scaling AI-native systems, focusing on state management, observability, and blast radius analysis.

Optimizes Dify workflows and plugins by restructuring graphs, reducing LLM token usage, tuning worker pools, and improving parallel processing.

Designs Elasticsearch indexes and mappings, tunes queries, sizes clusters, and handles operations like shard/replica strategy, ILM, monitoring, troubleshooting, and safe reindexing or upgrades.

Adds observability and debugging for AI-assisted application workflows using Sentry.

Connects error monitoring to MCP clients, enabling issue search, stack trace analysis, performance investigation, and AI-powered root cause analysis.

Synchronizes Datadog monitor definitions between environments using the Datadog API v2 monitors endpoint, with diff-based updates, tag filtering, and Terraform state reconciliation.

Queries and analyzes logs using Grafana Loki, including installation and configuration guidance.

Diagnose and observe an Oxla distributed analytical database using system catalog tables, Prometheus metrics, runtime log-level changes, and troubleshooting workflows for slow queries, node health, and memory/OOM pressure. Also covers debugging Oxla's external data sources, including the Redpanda/Kafka ingestion path.