Incident Postmortem

The problem

Writing incident reports after an outage is a chore that often leads to vague descriptions or finger-pointing. Developers struggle to turn messy Slack logs, alert timestamps, and deployment history into a coherent, blameless retrospective.

What it does

• Synthesizes raw evidence like chat logs, alert history, and deploy commits into a structured report.
• Constructs a minute-by-minute chronological timeline of the incident from start to resolution.
• Performs a 5-Whys root cause analysis to identify systemic failures rather than human error.
• Quantifies impact on customers, SLOs, and SLAs using available data or tagged estimates.
• Generates a prioritized list of action items categorized by prevention, detection, and response improvement.

Why this beats prompting it yourself

This skill enforces a strict blameless methodology and a 5-Whys deep dive that generic prompts often skip. It automatically handles the tedious formatting of timelines and action item tables, ensuring your engineering team maintains a consistent standard for every P1 incident.

Use cases

• Creating a formal retrospective after a production outage or service degradation.
• Analyzing a security event or data loss incident to prevent recurrence.
• Standardizing internal documentation for SRE and on-call teams.
• Reviewing a failed deployment to identify gaps in CI/CD or testing pipelines.

Known limitations

This skill is for post-incident review only. Do not use it for real-time incident response, blame attribution, or generating legal liability documentation.