alexzhu0 Incident Log To Postmortem
Purpose
Turn scattered incident material into a readable postmortem draft without overstating the root cause.
Fit
- Use when incident evidence needs to become a postmortem draft or follow-up action list.
- Do not use when the incident is still active and the priority is live mitigation.
Inputs
- Incident timeline, alerts, logs, status updates, or chat notes.
- Impact details, affected users, duration, and remediation steps if available.
- Current uncertainty or disputed explanations.
Workflow
- Build a chronological timeline from earliest signal to recovery.
- Separate confirmed facts from hypotheses.
- Identify impact, detection, mitigation, recovery, and prevention gaps.
- List root-cause candidates with evidence and confidence.
- Convert prevention ideas into owner-ready follow-up actions.
Output
Produce Markdown with:
- Incident Summary
- Impact
- Timeline
- Root-Cause Candidates
- What Worked
- What Failed
- Follow-Up Actions
- Open Questions
Validation
- Timeline entries include timestamps or clear ordering.
- Root cause is not claimed when only candidates exist.
- Impact is scoped to evidence.
- Follow-up actions have owners or owner placeholders.
- Blame language is removed; system factors are emphasized.