Example prompts
› Which accounts suddenly deleted a lot of projects in one day?
› Run the Activity Spike skill on our delete and export events
What this Skill does
Looks for concentration in time, not totals: an account firing one event many times on a single day (or within 3, 5, or 10 days). The threshold comes from your data (the 75th percentile of bursts, at least 3). Destructive and bulk actions like delete, remove, purge, archive, and bulk export are checked first, because a burst there often means a team is cleaning up or moving out.
When it fires
- One event fired at least N times within 1 / 3 / 5 / 10 days
- Threshold from your data: 75th percentile of bursts, at least 3
- Delete, remove, purge, archive, and bulk events first
Inputs
- Brazebee MCP: connected to Claude or ChatGPT with your Brazebee API key
- Product usage: Amplitude, PostHog, or Mixpanel connected in Brazebee
- Billing and CRM: Stripe and HubSpot for ARR, plan, renewal date, and account owner
How it works
- 01 / Buckets each event per account into 1-day (or longer) windows
- 02 / Takes each account's busiest bucket for that event
- 03 / Flags accounts whose burst reaches the threshold
- 04 / Compares renewal and churn rates against the rest
Output
Activity Spike: "project_deleted" at least 8x in one day
Cohort: 37 accounts · $290k ARR
Churn: 22% in cohort vs 6% in the rest (3.7x)
Act on: 3 accounts spiked this week
Route: CSM · Slack #cs-alerts · "Investigate the burst"Example numbers. Your thresholds and rates come from your own data.
Tips
- A spike can be good news too: a bulk import often means a new team onboarding
- Check spikes against your release notes first. A product change can cause bursts for everyone
- Route within a day. A clean-up is fastest to reverse while it is happening