Incident postmortem
Learn from the outage without a trial
Your AI writes a blameless incident review the way an incident commander would: a timeline built from evidence, impact and response metrics, several contributing factors, what went well, and action items with owners, dates and a 30-day check.
By Vander Labs. A Vander Labs Original, written by the Vander Labs team with AI assistance. Works with Claude, ChatGPT, Cursor and Claude Code.
What your AI learns
- Reconstructs a sourced UTC timeline and marks the gaps
- Finds four to six contributing conditions instead of one root cause
- Produces owned, dated, ticketed actions and a facilitation agenda
How it works
- Reserve the summary: Two to four sentences written last that still tell the truth to someone who stops there.
- Reconstruct the timeline: One row per event with UTC time, event and source, from the introducing change to full recovery.
- Quantify impact: Duration, users and requests affected, failed transactions, data lost or exposed, with derivations.
- Response metrics: Time to detect, acknowledge, mitigate and resolve, and whether detection was monitoring or a customer.
- Contributing factors: Conditions that made it possible, traced to systems and defaults, never to human error.
- What went well: Fast rollbacks, good runbooks, and the near misses where luck helped.
- Action items: Five to eight with owner, date, type, ticket and priority, favoring removal of failure classes.
- Facilitate: A 45-minute blameless agenda with a facilitator who did not make the change.
- Publish and follow up: Shared with the team within a week, linked from the ticket, actions checked at 30 days.
Limits and safety
- No sentence attributes fault to a person; decisions are described with the information available at the time.
- Data-exposure facts are flagged to whoever handles compliance notifications.
Topics: incident, postmortem, sre, reliability, blameless