---
name: production-incident-timeline
description: "Rebuilds an incident minute by minute from logs and chat into a clean timeline that pinpoints the first bad signal. Use when an engineer or incident lead has scattered logs, alerts, and chat from an outage and needs one ordered timeline that shows when it really began. Do not use for writing the full post-mortem or fixing the underlying bug. Related topics: devops, communication."
---

# Production Incident Timeline

Rebuilds an incident minute by minute from logs and chat into a clean timeline that pinpoints the first bad signal.

## When to use

Use this skill when an engineer or incident lead has scattered logs, alerts, and chat from an outage and needs one ordered timeline that shows when it really began. Do not use it for writing the full post-mortem or fixing the underlying bug.

## Workflow

1. Ask the user for each input listed below in a single message, skipping any they have already given. Where options are listed, offer them, but accept other answers too.
2. Normalise all timestamps to one timezone and flag sources with suspicious clocks.
3. Build a table of time, event, source, and actor covering detection, escalation, hypotheses, mitigation, and resolution.
4. Trace the logs backward from the first alert to find and mark the first bad signal.
5. Compute time to detect, mitigate, and resolve.
6. Separate facts from inferences, mark evidence gaps, and list open questions.

## Inputs

- **Incident name and date** (free text, e.g. "Short label and day")
- **Logs and alerts** (longer free text)
- **Chat transcript** (longer free text)
- **Deploys and config changes nearby** (longer free text)
- **Timezone of the sources** (free text, e.g. "UTC")
- **Customer impact known** (longer free text)

## Output

A timeline table, the first bad signal with its evidence, the three time metrics, a facts versus inferences list, and open questions.

## Prompt template

Fill the inputs into this template and follow it as the full instruction.

### Production Incident Timeline

Reconstruct the timeline of an incident from raw material.

- Incident name and date: {{Incident name and date}}
- Logs and alerts: {{Logs and alerts}}
- Chat transcript: {{Chat transcript}}
- Deploys and config changes nearby: {{Deploys and config changes nearby}}
- Timezone of the sources: {{Timezone of the sources}}
- Customer impact known: {{Customer impact known}}

Normalise every timestamp to one timezone before ordering anything, and flag any source whose clock looks off. Build the timeline as a table of time, event, source, and who acted. Include detection, escalation, each hypothesis tried, each mitigation, and resolution. Search the logs backward from the first alert to find the first bad signal, meaning the earliest sign of abnormal behaviour, and mark it clearly even if nobody noticed it then. Calculate time to detect, time to mitigate, and time to resolve. Separate facts taken from the sources from inferences, and mark gaps where evidence is missing. Do not assign blame or write causes as certain. End with open questions the team must answer and the data still needed.

## Pitfalls

- Mixing timezones, which makes the cause appear to follow the effect.
- Treating the first alert as the start, when the first bad signal came earlier.
- Stating inferences as facts and handing the team a false root cause.