incident-timeline-creation

Gather server logs, metrics dashboards, and chat history, then order events chronologically using logs as the source of truth. Tag each event with its type (root cause, detection, mitigation, recovery) and source, then calculate detection lag, response lag, and remediation time.

Use server logs as the primary source of truth since they are accurate to the second. Supplement with metrics dashboards for alert and error-rate timing, and chat history for human actions like acknowledgments and mitigation steps.

Detection lag is the time between the root cause event and the first alert firing. Response lag is the time between the alert and the first human acknowledgment. Both are derived by subtracting timestamps from logs, monitoring, and chat records.

Participant memory is typically off by plus or minus ten minutes and misses system-level events. Server logs and metrics provide second-level accuracy, so timelines should always be sourced from machine records rather than recollection.

Common mistakes include mixing time zones, starting from the alert instead of the actual root cause, and recording only human actions while ignoring metric changes and system errors. Convert all timestamps to UTC and include both system and human events.