Incident Postmortem Generator
Generate blameless incident postmortems from raw notes, Slack threads, or bullet points.
What It Does
Takes messy incident details and produces a structured postmortem document following Google/Atlassian SRE best practices.
Usage
Provide incident details in any format — timeline bullets, Slack copy-paste, verbal notes — and the agent will produce:
- Executive Summary — What happened, impact, duration, severity
- Timeline — Minute-by-minute from detection to resolution
- Root Cause Analysis — 5 Whys format, no finger-pointing
- Impact Assessment — Users affected, revenue impact, SLA breach
- Action Items — Prioritized fixes with owners and deadlines
- Lessons Learned — What worked, what didn't, what was lucky
- Prevention Measures — Systemic changes to prevent recurrence
Instructions
When the user provides incident details:
- Ask clarifying questions ONLY if critical info is missing (severity, duration, or resolution are the minimum)
- Generate the full postmortem in markdown
- Flag any gaps the team should fill in before publishing
- Suggest 3-5 specific, actionable prevention measures ranked by effort/impact
Formatting Rules
- Use ISO timestamps in timeline
- Bold severity level (SEV1-SEV4)
- Action items must have: description, owner placeholder, deadline placeholder, priority (P0-P3)
- Keep language blameless — "the deploy process" not "Bob deployed"
Severity Guide
- SEV1: Revenue-impacting, all users affected, >1hr
- SEV2: Major feature down, >30% users, >30min
- SEV3: Degraded performance, <30% users
- SEV4: Minor issue, workaround available
Example Input
prod went down at 2pm, bad deploy, rolled back at 2:45, ~500 users couldn't checkout, lost maybe $12k revenue
Example Output Structure
# Incident Postmortem: Checkout Service Outage
**Date:** 2026-02-22 | **Severity:** SEV1 | **Duration:** 45 minutes
**Author:** [Team Lead] | **Status:** Draft
## Executive Summary
...
Pro Tip
Run this after every incident, even small ones. The pattern recognition across postmortems is where the real value lives. Teams that write postmortems for SEV3+ incidents catch systemic issues 3x faster.
Need help building incident response processes from scratch? Check out the AfrexAI Context Packs — pre-built operational frameworks for SaaS, healthcare, legal, and 7 more industries. Starting at $47.
1---2name: incident-postmortem-generator3description: Generate blameless incident postmortems from raw notes, Slack threads, or bullet points.4---5
6# Incident Postmortem Generator
7
8Generate blameless incident postmortems from raw notes, Slack threads, or bullet points.
9
10## What It Does
11Takes messy incident details and produces a structured postmortem document following Google/Atlassian SRE best practices.
12
13## Usage
14Provide incident details in any format — timeline bullets, Slack copy-paste, verbal notes — and the agent will produce:
15
161. **Executive Summary** — What happened, impact, duration, severity
172. **Timeline** — Minute-by-minute from detection to resolution
183. **Root Cause Analysis** — 5 Whys format, no finger-pointing
194. **Impact Assessment** — Users affected, revenue impact, SLA breach
205. **Action Items** — Prioritized fixes with owners and deadlines
216. **Lessons Learned** — What worked, what didn't, what was lucky
227. **Prevention Measures** — Systemic changes to prevent recurrence
23
24## Instructions
25
26When the user provides incident details:
27
281. Ask clarifying questions ONLY if critical info is missing (severity, duration, or resolution are the minimum)
292. Generate the full postmortem in markdown
303. Flag any gaps the team should fill in before publishing
314. Suggest 3-5 specific, actionable prevention measures ranked by effort/impact
32
33### Formatting Rules
34- Use ISO timestamps in timeline
35- Bold severity level (SEV1-SEV4)
36- Action items must have: description, owner placeholder, deadline placeholder, priority (P0-P3)
37- Keep language blameless — "the deploy process" not "Bob deployed"
38
39### Severity Guide
40- **SEV1**: Revenue-impacting, all users affected, >1hr
41- **SEV2**: Major feature down, >30% users, >30min
42- **SEV3**: Degraded performance, <30% users
43- **SEV4**: Minor issue, workaround available
44
45## Example Input
46```
47prod went down at 2pm, bad deploy, rolled back at 2:45, ~500 users couldn't checkout, lost maybe $12k revenue
48```
49
50## Example Output Structure
51```markdown
52# Incident Postmortem: Checkout Service Outage
53**Date:** 2026-02-22 | **Severity:** SEV1 | **Duration:** 45 minutes
54**Author:** [Team Lead] | **Status:** Draft
55
56## Executive Summary
57...
58```
59
60## Pro Tip
61Run this after every incident, even small ones. The pattern recognition across postmortems is where the real value lives. Teams that write postmortems for SEV3+ incidents catch systemic issues 3x faster.
62
63---
64
65Need help building incident response processes from scratch? Check out the [AfrexAI Context Packs](https://afrexai-cto.github.io/context-packs/) — pre-built operational frameworks for SaaS, healthcare, legal, and 7 more industries. Starting at $47.
modbender