incident-response

Use the update mode to generate a structured status update containing severity, current status, impact, actions taken, next steps, and an event timeline. Updates should be factual, posted at a regular cadence, and avoid speculation.

Run the postmortem mode to generate a document with summary, impact, timeline, root cause, 5-whys analysis, what went well and poorly, and action items with owners. The process focuses on systems and processes rather than individuals.

Incidents are classified SEV1 through SEV4. SEV1 means service down for all users requiring immediate all-hands response, SEV2 is major degradation within 15 minutes, SEV3 is minor issues within an hour, and SEV4 is cosmetic issues handled next business day.

Yes, when monitoring, incident management, or chat connectors are available, the workflow can pull alert details, create or update incidents in PagerDuty or Opsgenie, page on-call responders, and post updates to incident channels.

The workflow generates documentation and guidance but does not execute remediation itself. Without connected integrations, tasks like paging responders, pulling metrics, and posting to chat must be performed manually by the team.