Incident postmortem from a raw timeline

Turns logs and a chat transcript into a blameless postmortem with contributing factors, not a culprit.

Writing incidentpostmortemops Verified 2026-11-02

When to use it

The day after an incident, with a messy timeline and no one volunteering to write it up.

The prompt

Copy into your assistant
Write a blameless postmortem from the timeline below.

Structure:
1. What happened, in two sentences a non-engineer can follow.
2. Impact: who was affected, for how long, and what they could not do.
3. Timeline: one line per event, with timestamps.
4. Contributing factors: at least three, each phrased as a system property rather than a person's mistake ("the deploy had no canary", not "Sam deployed badly").
5. What would have caught this earlier, ranked by cost to implement.

Rules:
- No names of individuals anywhere in the document.
- Do not invent events not present in the timeline; mark gaps as "unknown".
- Do not write "human error" as a cause. It is the beginning of the analysis, not the end.

Timeline:
<timeline>

Systems involved:
<systems>

What to change

If the timeline is chat logs, strip the jokes and side threads before pasting — they get summarised as facts otherwise.

Why it works

The prohibition on names and on "human error" is what makes a postmortem useful. Both are the default output of an unconstrained model, and both end the investigation early.

More writing prompts

Going deeper

More prompts

All prompts