# Incident Log To Postmortem

> Use when summarizing incident logs, outage timelines, status updates, alerts, or team notes into a clear postmortem with impact, timeline, root-cause candidates, and follow-up actions.

- Skill: `alexzhu0/incident-log-to-postmortem` (Agent Skill)
- Install (CLI): `npx skillmds@latest add alexzhu0/incident-log-to-postmortem`
- Raw SKILL.md: https://api.skillmd.com/api/skills/alexzhu0/incident-log-to-postmortem/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: alexzhu0 (https://skillmd.com/u/alexzhu0)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/alexzhu0/incident-log-to-postmortem

---


# Incident Log To Postmortem

## Purpose

Turn scattered incident material into a readable postmortem draft without overstating the root cause.

## Fit

- Use when incident evidence needs to become a postmortem draft or follow-up action list.
- Do not use when the incident is still active and the priority is live mitigation.

## Inputs

- Incident timeline, alerts, logs, status updates, or chat notes.
- Impact details, affected users, duration, and remediation steps if available.
- Current uncertainty or disputed explanations.

## Workflow

1. Build a chronological timeline from earliest signal to recovery.
2. Separate confirmed facts from hypotheses.
3. Identify impact, detection, mitigation, recovery, and prevention gaps.
4. List root-cause candidates with evidence and confidence.
5. Convert prevention ideas into owner-ready follow-up actions.

## Output

Produce Markdown with:

- Incident Summary
- Impact
- Timeline
- Root-Cause Candidates
- What Worked
- What Failed
- Follow-Up Actions
- Open Questions

## Validation

- Timeline entries include timestamps or clear ordering.
- Root cause is not claimed when only candidates exist.
- Impact is scoped to evidence.
- Follow-up actions have owners or owner placeholders.
- Blame language is removed; system factors are emphasized.