Loading
Fill this in within two working days, while people still remember.
| Field | Value |
|---|---|
| Incident | [Short name] |
| Date | [When] |
| Severity | [Sev 1–4] |
| Duration | [Detection to resolution] |
| Customers affected | [Number or proportion] |
| What broke | [One sentence, no jargon] |
| Detected by | [Monitoring, or a customer — this matters] |
| Author | [Name] |
"Detected by: a customer" is the most useful line in the document.
One row per event. Times, not adjectives.
| Time | Event | Who |
|---|---|---|
| [09:14] | [First error in logs] | |
| [09:41] | [Customer reports it] | |
| [09:52] | [Acknowledged, investigation starts] | |
| [10:20] | [Cause identified] | |
| [10:35] | [Fix deployed] | |
| [11:00] | [Confirmed resolved] |
The gap between the first log line and the acknowledgement is usually the finding.
Causes are conditions, not people. Every action has an owner and a date.
| Contributing cause | Action | Owner | Due | Done |
|---|---|---|---|---|
| [What made this possible] | [The change that prevents it] | |||
| [What delayed detection] | [The alert that would have caught it] | |||
| [What delayed the fix] | [The runbook or access that was missing] |
A postmortem with no dated actions is a story. Three owned actions beat ten unowned ones.