incident-postmortem-writer

name	incident-postmortem-writer
description	Turn incident timelines, logs, tickets, and chat snippets into a clear postmortem covering impact, detection, root cause, contributing factors, remediation items, and prevention steps. Use after outages, degraded service events, or security incidents.

Incident Postmortem Writer

Overview

Write postmortems that improve systems, not narratives that assign blame.

Core Workflow

1. Build a factual timeline from logs, alerts, tickets, and communications.
2. Quantify impact, affected users, duration, and detection quality.
3. Identify the triggering cause, contributing factors, and why safeguards did not stop the incident.
4. Convert remediation into clear action items with owners, priority, and prevention intent when possible.
5. Write the final document in a blameless tone with facts separated from inference.

Deliver

• Include a short executive summary before the detailed timeline.
• Make the distinction between root cause and contributing conditions explicit.
• End with concrete preventive actions instead of vague lessons learned.

Guardrails

• Do not hide uncertainty; mark missing evidence clearly.
• Avoid naming individuals as the cause.
• Keep the document useful for both technical and operational follow-up.