Incident Response

Stabilize first. Then find the blast radius, the trigger, and the fix that will not make it worse. Use when the user asks to incident.

delzarsolutionsllc Updated

File contents

Incident Response

Priority is user impact, then stop the bleeding, then understand, then fix, then write it down.

Stabilize

  1. Is it still happening? Who is affected? Since when?
  2. Roll back or disable the last change if that is the faster restore. Fix-forward only when rollback is impossible or worse.
  3. Do not deploy unrelated changes during the incident.

Diagnose

  • Symptom, first bad version, first bad config, first bad query.
  • Blast radius: which tenants, regions, tables.
  • One timeline with timestamps. Guessing is labeled as a guess.

Close

  • User-facing status if that is your job.
  • Fix + regression test or guard.
  • Follow-ups with owners. "We should monitor this" is not a follow-up.

Do not write a witty postmortem. Write a dull, true one.

delzarsolutionsllc/grok-skills/tree/main/skills/incident-response commit 19e52db8aa

Frequently asked questions

npx skillmds@latest add delzarsolutionsllc/incident-response