Skip to main content
The /armor:investigate skill performs root cause analysis by combining lineage, intelligence, and historical data.

​
Usage

/armor:investigate
Or ask naturally:
  • “Why is this table stale?”
  • “What caused this alert?”
  • “Debug the orders pipeline issue”

​
Investigation Workflow

  1. Gather Context: Check current status, recent alerts, freshness
  2. Trace Dependencies: Use lineage to find upstream issues
  3. Analyze Patterns: Check historical data for recurring problems
  4. Recommend Actions: Suggest fixes based on findings

​
Example Usage

​
Investigate Stale Table

You: Why is the orders table stale?

Claude: Investigating orders table...

Current Status:
- Status: STALE
- Last update: Yesterday 6:00 AM
- Expected: Today 6:00 AM
- Delay: 24 hours

Root Cause Analysis:
Tracing upstream dependencies...

Found root cause: staging.orders_raw

Dependency chain:
  raw.events (FRESH)
    -> staging.orders_raw (STALE - 24h)
      -> orders (STALE - 24h)

The staging.orders_raw table stopped updating at 5:45 AM yesterday.
This matches the time of an ETL job failure alert.

Recommendation:
1. Check Airflow logs for orders_etl DAG
2. Look for connection issues to source database
3. Once fixed, data should propagate within 1 hour

​
Investigate Alert

You: What caused the schema change alert?

Claude: Investigating schema change alert...

Alert Details:
- Table: warehouse.public.users
- Change: Column 'phone_number' added
- Detected: Tuesday 3:30 PM
- Status: Pending review

Change Analysis:
- Column type: VARCHAR(20)
- Nullable: YES
- No default value

Impact Assessment:
- 3 downstream tables may need updates
- No breaking changes detected (additive only)
- Compatible with existing queries

Historical Context:
- Similar changes happened 2 months ago (loyalty_tier added)
- Pattern suggests feature releases trigger schema updates

Recommendation:
1. Acknowledge the change if expected
2. Update downstream ETL if needed
3. No immediate action required

​
Common Questions

​
Can the investigate skill find root causes outside AnomalyArmor, like Airflow or dbt failures?

No. The agent stops at the edge of AnomalyArmor’s visibility, so it can identify which upstream table is stale and when it stopped updating, but it can’t read your orchestrator’s logs. It does surface the ETL time window and affected tables so you know where to look.

Lineage

Trace dependencies

Alerts

Alert details

Status

Health overview