Production Incident Analysis
Use generic terminology and preserve the status of every material statement: observed fact, proposal, ratified decision, rejected decision, unresolved question, measured result, estimate, or causal claim.
Workflow
- Define incident scope, impact, affected users, environment, detection, start, mitigation, recovery, and evidence custody.
- Build a timestamped timeline from logs, metrics, traces, alerts, changes, communications, and operator actions.
- Distinguish triggering event, contributing conditions, propagation, detection gaps, response friction, and recovery controls.
- Test causal claims against competing explanations and identify uncertainty or missing telemetry.
- Assess user, data, security, compliance, financial, and operational impact with supported units.
- Identify corrective actions across prevention, detection, containment, recovery, process, and learning.
- Assign owners, priorities, validation, due conditions, and effectiveness review.
Boundaries
- Do not blame individuals or infer intent from incomplete operational evidence.
- Do not disclose secrets, personal data, or protected incident details.
- Do not claim root cause, full recovery, or action completion without exact evidence.
Output
Return Impact, Timeline, Detection, Causal analysis, Contributing conditions, Response, Recovery evidence, Actions, and Unresolved questions.
1---2name: production-incident-analysis3description: Analyze a production incident using timestamped evidence, system behavior, contributing conditions, response actions, and recovery. Use after an incident to establish what happened, why controls failed, and what learning or remediation is justified.4license: MIT5---67# Production Incident Analysis89Use generic terminology and preserve the status of every material statement: observed fact, proposal, ratified decision, rejected decision, unresolved question, measured result, estimate, or causal claim.1011## Workflow12131. Define incident scope, impact, affected users, environment, detection, start, mitigation, recovery, and evidence custody.142. Build a timestamped timeline from logs, metrics, traces, alerts, changes, communications, and operator actions.153. Distinguish triggering event, contributing conditions, propagation, detection gaps, response friction, and recovery controls.164. Test causal claims against competing explanations and identify uncertainty or missing telemetry.175. Assess user, data, security, compliance, financial, and operational impact with supported units.186. Identify corrective actions across prevention, detection, containment, recovery, process, and learning.197. Assign owners, priorities, validation, due conditions, and effectiveness review.2021## Boundaries2223- Do not blame individuals or infer intent from incomplete operational evidence.24- Do not disclose secrets, personal data, or protected incident details.25- Do not claim root cause, full recovery, or action completion without exact evidence.2627## Output2829Return Impact, Timeline, Detection, Causal analysis, Contributing conditions, Response, Recovery evidence, Actions, and Unresolved questions.30
JovaniPink