Incident Report Skill
Generate comprehensive incident reports and post-mortems following team standards. Supports two report types: internal technical analysis and client-facing communications.
Quick Start
- Classify the incident (severity, type, audience)
- Gather information using the discovery prompts
- Generate the appropriate report using templates
- Review using the checklist
Phase 1: Classification
Severity Levels
| Level |
Criteria |
Response Time |
| P0 Critical |
Data breach, cross-tenant exposure, complete outage |
Immediate |
| P1 High |
Partial outage, significant performance degradation, security vulnerability |
< 1 hour |
| P2 Medium |
Degraded service, non-critical feature down |
< 4 hours |
| P3 Low |
Minor issue, cosmetic, workaround available |
Next business day |
Incident Types
- Outage: Service unavailable or severely degraded
- Security: Vulnerability, unauthorized access, data exposure
- Data Leak: Customer data exposed to wrong party
- Performance: Latency spikes, memory issues, 5xx errors
- Configuration: Misconfig causing issues, deployment failures
Report Audience
| Audience |
Report Type |
Focus |
| Internal |
Technical post-mortem |
Root cause, technical details, action items |
| Client |
Customer communication |
Impact, resolution, prevention, reassurance |
Phase 2: Information Gathering
Before writing, gather these details. Ask the user if any are missing:
Core Facts (Required)
- Incident date and time (with timezone)
- Duration of impact
- Affected systems/services
- Affected customers/sites
- Who detected it (monitoring, customer report, internal)
- Current status (ongoing, resolved, monitoring)
Technical Details (Internal Reports)
- What was the root cause?
- What was the timeline? (detection → investigation → fix → verification)
- What commands/logs showed the issue?
- What was the fix applied?
- Were there any secondary effects?
Impact Assessment
- Number of affected requests/users
- Error rates (percentage)
- Revenue impact (if applicable)
- Data exposure scope (if security/data leak)
- Customer complaints received
Resolution Details
- What immediate fix was applied?
- Who was involved in resolution?
- How was the fix verified?
- Are there follow-up actions needed?
Phase 3: Generate Report
Internal Technical Report
Use template: templates/internal-report.md
Structure:
- TL;DR - 3-5 bullet summary for busy readers
- Executive Summary - One paragraph overview
- Timeline - Chronological events
- Root Cause Analysis - Technical deep-dive
- Impact - Quantified effects
- Resolution - What was done
- Action Items - TODO list with owners
- Lessons Learned - Blameless retrospective
- References - Links, logs, PRs
Client-Facing Report
Use template: templates/client-report.md
Structure:
- Subject Line - Clear, professional
- Acknowledgment - We take this seriously
- What Happened - Non-technical explanation
- Impact on You - Specific to this client
- Resolution - What we did
- Prevention - What we're doing to prevent recurrence
- Contact - Who to reach for questions
Phase 4: Review Checklist
Before finalizing, verify:
Content Quality
Client Reports Additional
Security Incidents Additional
Blameless Post-Mortem Principles
- Focus on systems, not people - "The monitoring gap allowed..." not "John failed to..."
- Assume good intent - Everyone was trying to do the right thing
- Learn, don't punish - Goal is improvement, not blame
- Be specific - "Deploy at 14:32 caused..." not "Recent changes caused..."
- Quantify impact - "2% of 30k requests = 600 errors" not "some errors"
Writing Tips
For Internal Reports
- Be technically precise
- Include actual commands, logs, configs
- Link to related PRs, issues, dashboards
- Use diagrams for complex flows
For Client Reports
- Lead with resolution/status
- Avoid defensive language
- Be specific about prevention measures
- Keep under 500 words unless complex
- Translate technical terms
File Naming Convention
{slug}-{YYYY-MM-DD}.md
Examples:
- istio-xds-message-overflow-2026-02-03.md
- openbox2-traffic-spike-502-2026-02-05.md
- aviator-cross-tenant-routing-2026-02-03.md
Additional Resources
- templates/internal-report.md - Full internal template
- templates/client-report.md - Client communication template
- references/5-whys.md - Root cause analysis technique
1---2name: incident-report3description: Create incident reports and post-mortems for platform issues. Supports both internal technical reports and client-facing communications. Use when documenting outages, security vulnerabilities, data leaks, performance degradation, or any production incident.4---56# Incident Report Skill78Generate comprehensive incident reports and post-mortems following team standards. Supports two report types: internal technical analysis and client-facing communications.910## Quick Start11121. **Classify** the incident (severity, type, audience)132. **Gather** information using the discovery prompts143. **Generate** the appropriate report using templates154. **Review** using the checklist1617## Phase 1: Classification1819### Severity Levels2021| Level | Criteria | Response Time |22|-------|----------|---------------|23| **P0 Critical** | Data breach, cross-tenant exposure, complete outage | Immediate |24| **P1 High** | Partial outage, significant performance degradation, security vulnerability | < 1 hour |25| **P2 Medium** | Degraded service, non-critical feature down | < 4 hours |26| **P3 Low** | Minor issue, cosmetic, workaround available | Next business day |2728### Incident Types2930- **Outage**: Service unavailable or severely degraded31- **Security**: Vulnerability, unauthorized access, data exposure32- **Data Leak**: Customer data exposed to wrong party33- **Performance**: Latency spikes, memory issues, 5xx errors34- **Configuration**: Misconfig causing issues, deployment failures3536### Report Audience3738| Audience | Report Type | Focus |39|----------|-------------|-------|40| **Internal** | Technical post-mortem | Root cause, technical details, action items |41| **Client** | Customer communication | Impact, resolution, prevention, reassurance |4243## Phase 2: Information Gathering4445Before writing, gather these details. Ask the user if any are missing:4647### Core Facts (Required)4849```50- Incident date and time (with timezone)51- Duration of impact52- Affected systems/services53- Affected customers/sites54- Who detected it (monitoring, customer report, internal)55- Current status (ongoing, resolved, monitoring)56```5758### Technical Details (Internal Reports)5960```61- What was the root cause?62- What was the timeline? (detection → investigation → fix → verification)63- What commands/logs showed the issue?64- What was the fix applied?65- Were there any secondary effects?66```6768### Impact Assessment6970```71- Number of affected requests/users72- Error rates (percentage)73- Revenue impact (if applicable)74- Data exposure scope (if security/data leak)75- Customer complaints received76```7778### Resolution Details7980```81- What immediate fix was applied?82- Who was involved in resolution?83- How was the fix verified?84- Are there follow-up actions needed?85```8687## Phase 3: Generate Report8889### Internal Technical Report9091Use template: [templates/internal-report.md](templates/internal-report.md)9293Structure:941. **TL;DR** - 3-5 bullet summary for busy readers952. **Executive Summary** - One paragraph overview963. **Timeline** - Chronological events974. **Root Cause Analysis** - Technical deep-dive985. **Impact** - Quantified effects996. **Resolution** - What was done1007. **Action Items** - TODO list with owners1018. **Lessons Learned** - Blameless retrospective1029. **References** - Links, logs, PRs103104### Client-Facing Report105106Use template: [templates/client-report.md](templates/client-report.md)107108Structure:1091. **Subject Line** - Clear, professional1102. **Acknowledgment** - We take this seriously1113. **What Happened** - Non-technical explanation1124. **Impact on You** - Specific to this client1135. **Resolution** - What we did1146. **Prevention** - What we're doing to prevent recurrence1157. **Contact** - Who to reach for questions116117## Phase 4: Review Checklist118119Before finalizing, verify:120121### Content Quality122- [ ] Timeline is accurate and complete123- [ ] Root cause is clearly identified (not symptoms)124- [ ] Impact is quantified with real numbers125- [ ] Action items have owners and priorities126- [ ] No blame assigned to individuals127128### Client Reports Additional129- [ ] Technical jargon removed or explained130- [ ] Tone is professional and empathetic131- [ ] Next steps are clear132- [ ] Contact information included133- [ ] Client-specific impact addressed134135### Security Incidents Additional136- [ ] Scope of exposure documented137- [ ] Affected data types listed138- [ ] Customer notification requirements checked139- [ ] Compliance implications noted (LGPD, GDPR)140141## Blameless Post-Mortem Principles1421431. **Focus on systems, not people** - "The monitoring gap allowed..." not "John failed to..."1442. **Assume good intent** - Everyone was trying to do the right thing1453. **Learn, don't punish** - Goal is improvement, not blame1464. **Be specific** - "Deploy at 14:32 caused..." not "Recent changes caused..."1475. **Quantify impact** - "2% of 30k requests = 600 errors" not "some errors"148149## Writing Tips150151### For Internal Reports152- Be technically precise153- Include actual commands, logs, configs154- Link to related PRs, issues, dashboards155- Use diagrams for complex flows156157### For Client Reports158- Lead with resolution/status159- Avoid defensive language160- Be specific about prevention measures161- Keep under 500 words unless complex162- Translate technical terms163164## File Naming Convention165166```167{slug}-{YYYY-MM-DD}.md168169Examples:170- istio-xds-message-overflow-2026-02-03.md171- openbox2-traffic-spike-502-2026-02-05.md172- aviator-cross-tenant-routing-2026-02-03.md173```174175## Additional Resources176177- [templates/internal-report.md](templates/internal-report.md) - Full internal template178- [templates/client-report.md](templates/client-report.md) - Client communication template179- [references/5-whys.md](references/5-whys.md) - Root cause analysis technique
decocms