methodatlas
Playbook

Learn from Incident

Move from scattered logs and memories to timeline, learning points, and concrete improvements.

Outcome

A blameless postmortem with timeline, contributing factors, actions, and follow-up.

At the end you have

Incident TimelineCausal Factor MapBlameless PostmortemUpdated Runbook

Decision point

You can decide which systemic improvements are prioritized and which operational adjustments are needed immediately.

Next step

Track actions with owners, update runbooks or alerts, and check the learning effect in the next review.

Ideal for

  • SRE and DevOps incidents
  • Critical production disruptions
  • Recurring operational problems

Not good for

  • Acute incident command
  • Blame-oriented escalations
Preparation

What should be clear before you start

Roles

  • Incident lead or facilitator
  • Involved engineers and operations roles
  • Service owner or product responsible

Inputs

  • Logs, alerts, and chat history
  • Times of important decisions
  • Known impact on users or operations

Setup

  • Set a blameless frame
  • Collect sources upfront
  • Clarify review goal and follow-up mechanism
Flow

Method path

0 methods
    Completion criteria
    Templates

    Artifacts for this playbook

    Artifacts stay collapsed until you actually need them.

    MarkdownShow template

    Incident Timeline

    Chronological template for incident reconstruction with sources and uncertainty.

    # Incident Timeline

**Incident:** ...
**Period:** ...
**Sources:** logs, alerts, chat, tickets

| Time | Event | Source | Confidence | Note |
|---|---|---|---|---|
| HH:MM | | | high/medium/low | |

## Observed delays

- ...

## Open gaps

- ...

## Learnings

- ...
    MarkdownShow template

    Blameless Postmortem

    Template for learning, contributing factors, and follow-up actions after an incident.

    # Blameless Postmortem

## Summary

What happened, and what impact did it have?

## Impact

- Customer impact:
- Duration:
- Affected systems:

## Timeline

Link or excerpt from the timeline.

## Contributing factors

- ...

## What went well?

- ...

## What should we improve?

| Action | Owner | Date | Expected impact |
|---|---|---|---|

## Follow-up

Review date and status.
    ChecklistShow template

    Runbook Checklist

    Checklist for operational runbooks with trigger, diagnosis, action, rollback, and escalation.

    - [ ] Trigger described clearly
- [ ] Prerequisites and access listed
- [ ] Diagnosis steps in order
- [ ] Actions with expected effect
- [ ] Verification after each critical action
- [ ] Rollback or stop criterion
- [ ] Escalation path with contact
- [ ] Last test run documented