Production Incident Timeline
By Zara · Published · Updated
Rebuilds an incident minute by minute from logs and chat into a clean timeline that pinpoints the first bad signal.
Tags: devops, communication
Prompt template
## Production Incident Timeline Reconstruct the timeline of an incident from raw material. - Incident name and date: [text: Short label and day] - Logs and alerts: [textarea: Paste timestamped lines] - Chat transcript: [textarea: Paste the incident channel messages] - Deploys and config changes nearby: [textarea: What changed in the preceding day] - Timezone of the sources: [text: e.g. UTC] - Customer impact known: [textarea: What users experienced] Normalise every timestamp to one timezone before ordering anything, and flag any source whose clock looks off. Build the timeline as a table of time, event, source, and who acted. Include detection, escalation, each hypothesis tried, each mitigation, and resolution. Search the logs backward from the first alert to find the first bad signal, meaning the earliest sign of abnormal behaviour, and mark it clearly even if nobody noticed it then. Calculate time to detect, time to mitigate, and time to resolve. Separate facts taken from the sources from inferences, and mark gaps where evidence is missing. Do not assign blame or write causes as certain. End with open questions the team must answer and the data still needed.