postmortem

Turns incident work, roles, and countermeasures into a tangible result by collecting sources, ordering events chronologically, and deriving lessons and actions.

Core question: What happened when, which signals and decisions shaped the incident, and where are the learning points?

60-180 min

3-10