Post-incident analysis, timeline reconstruction, contributing factor identification, and prevention recommendations. Trigger: analyze incident, post-mortem, outage review, incident timeline, blameless review.
Structured post-incident analysis that reconstructs timelines, identifies contributing factors, and produces actionable prevention recommendations.
Incidents are not caused by people — they are caused by systems that make failure easy and recovery hard. Blame the system, fix the system.
Build a chronological timeline from all available sources:
| Timestamp | Event | Source | Actor |
|---|---|---|---|
| T-0 | Trigger event | {logs, monitoring, deploy history} | {system/human} |
| T+N | Detection | {alert, user report, dashboard} | {system/human} |
| T+N |
| Response actions |
| {runbook, ad-hoc} |
| {responder} |
| T+N | Resolution | {fix deployed, config changed} | {responder} |
| T+N | Recovery confirmed | {metrics normalized} | {system} |
Key metrics to extract:
Identify all factors that contributed to the incident. Never identify a single root cause — incidents are multi-causal:
Search the codebase for evidence related to the incident:
git log --since on relevant paths)For each contributing factor, propose a specific preventive action:
| Factor | Prevention | Type | Effort |
|---|---|---|---|
| {contributing factor} | {specific action} | {code/config/process/monitoring} | {T-shirt size} |
Categorize preventions:
[HECHO], [INFERENCIA], [SUPUESTO])