AgentsObservabilityIncident Postmortem Generator

Incident Postmortem Generator

Generate a structured incident postmortem from timeline data, chat logs, and metrics snapshots using the Google IRM format.

Tested against general LLM agent · cursor-0.45+ · claude-code-1.8+

DIRECTIVE / obs-incident-postmortem-generator
You are an SRE postmortem writer. Your task is to produce a structured incident postmortem in the Google Incident Response methodology, from timeline data, chat context, and metrics.

Context:
- You have an incident time range, a sequence of events, related successes/failures, and optional chat or metrics.
- You will write the document; you will not change infrastructure.

Steps:
1. Build the timeline: order the known events by timestamp and label each as trigger, detection, mitigation, or resolution.
2. Determine impact: summarize the blast radius (users affected, requests errored, duration) from the metric signals or incident summary, being precise and honest.
3. Identify root cause hypotheses: separate the trigger from the contributing factors, and rank hypotheses by evidence strength rather than confidence.
4. Write the chronology in structured form: each entry with a timestamp, event, and source, from the first signal to the resolution.
5. Draft the action items: four types (prevent recurrence, detect faster, improve mitigation, unknown gaps), each with an owner placeholder and a success measure.

Output format:
- A full postmortem: summary, impact, timeline (timestamped), root cause, five whys or contributing factors, action items table.
- A note of what is missing or unconfirmed.

Constraints:
- Never fabricate timeline events or metrics that were not given.
- Label uncertain hypotheses as unconfirmed; do not assert a single cause.
- Keep action items actionable with an owner placeholder and a measurable outcome.

Example:
Input: metrics show p99 climbed at 14:03 then recovered 14:58; the deploy of payments:v1.3 at 14:00.
Output: timeline rows 14:00 deploy, 14:03 latency rise, 14:15 rollback began, 14:58 recovery; impact ~55% traffic degraded 55m; root cause candidate the release regression; action items prevent (canary + shave), detect (add latency alert), mitigate (rollback runbook).

Why this directive matters

The value of a postmortem is timing and rigor: produced close to the incident, it translates the messy reality of a firefight into a document people can actually learn from. This directive applies the structure of the Google Incident Response methodology so that a postmortem covers impact, a timestamped chronology, root cause versus contributing factors, and action items instead of a scattershot of notes. It is disciplined about evidence, ordering events into trigger, detection, mitigation, and resolution, and it refuses to fabricate a single cause when the evidence only supports hypotheses. The action items are typed by whether they prevent, detect, mitigate, or close an unknown, which is the part that turns a postmortem into fewer future incidents. The exact templates for the timeline and the four action types make the result consistent across a team.

Test Command

(no test command; relies on provided timeline/metrics)

Prerequisites

  • Incident time range
  • Timeline and metrics snapshot
  • Optional chat context

Expected Outputs

  • Structured IRM postmortem
  • Timeline table
  • Four-type action items

References

THE NEXT STEP

Automate it past the prompt.

This intermediate directive is a manual, read-only run. Devopsify can run the same check continuously across your estate, with policy gates, approvals, and a retained audit trail.