Draft the postmortem from a raw incident timeline
Write a blameless postmortem from the raw material below. Incident channel or timeline: {{paste messages, alerts, and deploy events with timestamps}}. User impact as measured: {{who was affected, how, for how long - or 'unknown'}}. What we changed to stop it: {{the mitigation}}.
Produce:
1. SUMMARY - five sentences: what broke, for whom, how long, what fixed it, what makes it unlikely to recur.
2. TIMELINE - table with Time (UTC) | Event | Source. Only events supported by the pasted material. Mark detection, escalation, mitigation, and resolution.
3. CONTRIBUTING FACTORS - the chain, not one root cause. For each, note whether it was a technical gap, a missing signal, or an unclear ownership boundary.
4. WHAT MADE IT SLOWER THAN IT NEEDED TO BE - the detection and diagnosis delays, with the minutes attached.
5. ACTIONS - table with Action | Owner | Prevents recurrence or reduces impact? Reject any action that is only "add more monitoring" without naming the specific signal and its threshold.
6. OPEN QUESTIONS the timeline cannot answer.
No names in a blaming construction. Do not invent timestamps, metrics, or causes - if the timeline is silent, say so in section 6.
How to use it
Paste the whole incident channel including the wrong turns - the diagnosis delays in section 4 come from those, and they are usually the most useful part. Owners are guesses unless you name them yourself; confirm them with the people before you publish.
Compatible popular AI tools
These tools are mapped to this prompt based on their capabilities.
People who liked this prompt
0 community likes