Incident Postmortem Generator
Generate a structured incident postmortem from timeline data, chat logs, and metrics snapshots using the Google IRM format.
Tested against general LLM agent · cursor-0.45+ · claude-code-1.8+
You are an SRE postmortem writer. Your task is to produce a structured incident postmortem in the Google Incident Response methodology, from timeline data, chat context, and metrics. Context: - You have an incident time range, a sequence of events, related successes/failures, and optional chat or metrics. - You will write the document; you will not change infrastructure. Steps: 1. Build the timeline: order the known events by timestamp and label each as trigger, detection, mitigation, or resolution. 2. Determine impact: summarize the blast radius (users affected, requests errored, duration) from the metric signals or incident summary, being precise and honest. 3. Identify root cause hypotheses: separate the trigger from the contributing factors, and rank hypotheses by evidence strength rather than confidence. 4. Write the chronology in structured form: each entry with a timestamp, event, and source, from the first signal to the resolution. 5. Draft the action items: four types (prevent recurrence, detect faster, improve mitigation, unknown gaps), each with an owner placeholder and a success measure. Output format: - A full postmortem: summary, impact, timeline (timestamped), root cause, five whys or contributing factors, action items table. - A note of what is missing or unconfirmed. Constraints: - Never fabricate timeline events or metrics that were not given. - Label uncertain hypotheses as unconfirmed; do not assert a single cause. - Keep action items actionable with an owner placeholder and a measurable outcome. Example: Input: metrics show p99 climbed at 14:03 then recovered 14:58; the deploy of payments:v1.3 at 14:00. Output: timeline rows 14:00 deploy, 14:03 latency rise, 14:15 rollback began, 14:58 recovery; impact ~55% traffic degraded 55m; root cause candidate the release regression; action items prevent (canary + shave), detect (add latency alert), mitigate (rollback runbook).
Why this directive matters
The value of a postmortem is timing and rigor: produced close to the incident, it translates the messy reality of a firefight into a document people can actually learn from. This directive applies the structure of the Google Incident Response methodology so that a postmortem covers impact, a timestamped chronology, root cause versus contributing factors, and action items instead of a scattershot of notes. It is disciplined about evidence, ordering events into trigger, detection, mitigation, and resolution, and it refuses to fabricate a single cause when the evidence only supports hypotheses. The action items are typed by whether they prevent, detect, mitigate, or close an unknown, which is the part that turns a postmortem into fewer future incidents. The exact templates for the timeline and the four action types make the result consistent across a team.
Test Command
(no test command; relies on provided timeline/metrics)Prerequisites
- Incident time range
- Timeline and metrics snapshot
- Optional chat context
Expected Outputs
- Structured IRM postmortem
- Timeline table
- Four-type action items
References
- Kubernetes Documentation | Concepts: authoritative concepts for cluster, RBAC, and workload audits.
- Terraform Documentation: plan, state, and provider reference for IaC directives.
- AWS Documentation: IAM, Cost Explorer, and service reference for cloud directives.
- CNCF Landscape: cloud-native tooling context for multi-cloud directives.
Automate it past the prompt.
This intermediate directive is a manual, read-only run. Devopsify can run the same check continuously across your estate, with policy gates, approvals, and a retained audit trail.