Incident Library

Use when you have a case id (from search_incidents, list_incidents or get_topic) and need the whole write-up: symptoms, trigger, root cause, components, contributing factors, summary, impact, timeline, detection, remediation, action items, lessons, sources with archived copies, and the related cases.

Use to understand one category: its cases, and the other categories those cases carry with counts and case ids (for a symptom, the root causes behind it; for a root cause, the components and factors seen with it). With `symptoms`, the page is restricted to the cases that sentence finds, best match first, so 'certificate expiry, but only where DNS was involved' is one call. Kinds: root_causes, components, symptoms, factors, orgs (the organisations that published cases).

Use when the question is about a category rather than a symptom: cases with a given root cause, component, symptom, contributing factor, domain or organisation, newest first, one page at a time. Filters are slugs (kebab-case) and combine with AND; find a slug with vocab when you only have words. An unknown slug matches nothing. When the answer carries next_cursor, call again with cursor to get the following page.

Use first, whenever someone describes a failure they are seeing. Pass the symptoms as a sentence or a few words, in English or Korean; returns every reviewed public post-incident report the search finds for it, best match first: `total` is how many, `results` is one page of them in full (each with the case id, the page url and the source link), `matched` is every one as a row, and `next_cursor` fetches the next page. `interpreted` lists the values the sentence named, organisations included (the search moves cases carrying them up); `facets` count the results by root cause, component, symptom, contributing factor and organisation with the case ids, which answers 'what usually caused this' from the same call. The optional slug filters keep only cases carrying those values (AND); take slugs from facets, interpreted or vocab. Follow with get_incident for the full case.

Use to find the slug for a filter. With `query`, returns the vocabulary values nearest in meaning to the words, nearest first (e.g. 'cert ran out' finds certificate-expiry), optionally within one kind. Without `query`, returns every slug with its English and Korean name, per kind.