Tool
Incident Postmortem Template
A blameless postmortem builder. Work through the sections in order, then copy or download the Markdown for your wiki or ticket. The structure forces the questions that prevent recurrence: not "who", but "what made this possible and what made it hard to see".
Drafts autosave in this browser only. Nothing is uploaded.
Header
Summary & impact
Two to four sentences a director could read in 30 seconds. What happened, how long, who noticed.
Users affected, transactions failed, revenue or SLA impact, regulatory exposure.
How did we find out? Alert, customer report, someone noticed a graph? How long between start and detection?
Timeline
UTC, one row per event. Include when it started, detected, acknowledged, escalated, mitigated, resolved.
Analysis
Be systemic. "Engineer made a typo" is never a root cause. Why was a typo able to reach production? Why was it not caught?
The specific change or event that set it off (deploy, config change, traffic spike, dependency outage).
What stopped the bleeding, and what fixed it for good.
Action items
Every action has an owner and a due date, or it is a wish. Prefer actions that remove a class of failure over actions that add a checklist step.
Lessons
What should every team take away from this? Which assumption turned out to be false?