Complete firstIncident datanot in catalog
Symptoms, relevant times, logs, alerts, or observations are available in raw form.
Without: Without a clear scope, the team gathers material but cannot derive a robust structure or decision.
RunsheetDevOps
Incident Timeline Analysis
ComplexityMedium
Time60-180 min
Participants3-10
FormatWorkshop + async
MaturityEstablished
01
Prerequisite
What needs to be finished first
02
Preparation
What needs to be ready before start
Materials
Working board or document for incident timeline; existing notes, data, decisions, and assumptions; markers for uncertainty, owner, and next steps.
People / roles
Facilitator; functional experts from the affected area; one owner for result and follow-up; a named decider for decisions.
Pre-read
Scope, trigger, known facts, relevant constraints, prior options or events, and the desired outcome of the session.
Time needed
60-180 min
Setup
Prepare an empty Incident Timeline template. Keep scope and work question visible at the top. Mark each assumption as assumption, not as fact.
03
Core question
The one question this method answers
What happened when, which signals and decisions shaped the incident, and where are the learning points?
04
Flow
Marker: Phase
| Step | Duration | Action | Hint |
|---|---|---|---|
1Fix scope | 10-20 min | Define trigger, objective, and boundaries of the investigation. Capture off-topic topics on a parking lot. | A tight scope creates better outcomes than a complete but diffuse sweep. |
2Collect raw material | 20-40 min | Gather and visualize facts, events, options, constraints, or assumptions. | Keep facts and interpretations separate. Mark uncertain points instead of smoothing them over. |
3Build structure | 30-60 min | Fill in the incident timeline step by step, clarify relationships between elements, and surface contradictions. | Do not evaluate too early. Stabilize structure first, then draw conclusions. |
4Review and distill | 20-40 min | Mark gaps, weak assumptions, counterexamples, and critical paths. Check whether the result is understandable. | If no one can explain the logic in two minutes, the artifact is not ready yet. |
5Define next steps | 15-20 min | Document decision, experiment, test, measure, or follow-up with owner and date. | A high-quality artifact without a next action remains knowledge work without impact. |
05
Artifact
What comes out at the end
Form
Incident timeline with trigger, scope, key elements, assumptions, marked gaps, interpretation of outcome, and next step with owner and date.
Versioning / ownership
Save artifact with date, scope, and participants. When new evidence appears, create a new version or change log so decision logic remains traceable.
Tool alternatives
- Miro or FigJam
- Lucidchart or draw.io
- Confluence or Notion
- Google Docs or Sheets
- Markdown in repository
incident-timeline-markdown.md
Chronological template for incident reconstruction with sources and uncertainty.
Incident Timeline
Incident: ... Period: ... Sources: logs, alerts, chat, tickets
| Time | Event | Source | Confidence | Note |
|---|---|---|---|---|
| HH:MM | high/medium/low |
Observed delays
- ...
Open gaps
- ...
Learnings
- ...
06
Example output
Concrete filled scenario, fictional example
incident-timeline-analysis-beispiel.md
Concrete filled scenario, fictional example
Incident Timeline Analysis - API outage 12.05.2026
Scope: A concrete project area is assessed, not the entire company. Work question: What happened when, which signals and decisions shaped the incident, and where are the learning points?
Artifact excerpt:
- Fact 1: Current observation is documented and linked to a source.
- Assumption 1: The most important causal relationship is plausible but not yet proven.
- Critical point: An open condition determines whether the preferred path is sustainable.
Result: The team selects a focused next step with owner and date. Signal: Moving from scattered logs to actionable learning.
07
Pitfalls
Recognize symptoms and steer against them
Trap
Scope drifts
Symptom
New topics are continuously added and the artifact loses focus.
What to do
Keep scope visible and park new topics in a parking lot.
Trap
Assumptions become facts
Symptom
Discussion sounds certain even though evidence is missing.
What to do
Mark every uncertain statement and define a validation point.
Trap
Premature solution mode
Symptom
Team moves to actions within minutes.
What to do
Complete the structure first, then derive options or measures.
Trap
No counter-verification
Symptom
Artifact only confirms the favored hypothesis.
What to do
Ask explicitly for counterexamples, negative branches, or excluded options.
Trap
No owner
Symptom
Outcome is understandable, but no one continues it.
What to do
Always document the next step with owner, date, and success signal.
08
Stop criteria
Done signals checkable in under a minute
Trigger or scope is unclear.
No raw material or no participants with contextual knowledge are available.
The method is used to justify a decision that is already made.
Key assumptions cannot be discussed openly.
No owner is available for result or follow-up.
Finished the runsheet?
Go to the profile for purpose, similar methods, and sources or continue to the next method in the catalog.