Incident response & postmortem drafter
When an incident is assigned, an ops lead classifies severity, reconstructs the timeline, drafts the status updates, and writes a blameless postmortem with a 5-whys root cause and owned action items a reviewer checks — then lands one approval where you sign off.
Saves you ~3.8 h / run
How it works
- Trigger
- When you start the “Postmortem drafting” workflow.
- Job
- Triage and communicate, reconstruct the timeline and root cause, draft the postmortem.
- Outcome
- A verified incident report and postmortem draft with causes, actions, and owners.
What it installs
Agents 3
-
Incident Lead
Takes an incident from triage through a learning-grade postmortem with owned action items.
-
Postmortem Reviewer
Independently reviews the postmortem for blameless framing, causal soundness, and actionable items before sign-off.
-
Incident response & postmortem drafter Quality Reviewer
Checks primary evidence, domain controls, deliverable completeness, and communication quality, stopping the run when the work is wrong, unsupported, incomplete, or uncertain.
Teams 1
-
Incident Review Team
A lead who reconstructs and writes the postmortem and a reviewer who enforces blamelessness and causal soundness.
Workflows 1
-
Postmortem drafting
Triage and communicate, reconstruct the timeline and root cause, draft the postmortem, review it, and hand off for approval.
Skills 3
-
incident-response
Run an incident from detection through postmortem: triage and classify severity (SEV1-4), communicate factual cadenced status updates, track mitigation and timeline, then write a blameless postmortem with a 5-whys root cause and owned action items. Adapted from anthropics/knowledge-work-plugins/incident-response.
-
risk-assessment
Classify the risk of contributing factors using a severity × likelihood matrix (1-25 score, Green/Yellow/Orange/Red) to prioritize which remediations matter most and what warrants escalation. Adapted from anthropics/knowledge-work-plugins/risk-assessment.
-
stakeholder-update
Generate an incident update tailored to audience and cadence — internal/engineering detail, a leadership status with color and asks, or a plain customer-facing message — leading with the conclusion and staying factual. Adapted from anthropics/knowledge-work-plugins/stakeholder-update.
Requirements
- Incident source data — Alert details, monitoring graphs, the incident chat/war-room thread, deploy and change logs, and on-call notes for the incident being written up. The agent works from what you connect or attach.
Setup guide
How to Draft Incident Postmortems
A practical guide to drafting blameless incident postmortems from severity, timeline evidence, 5-whys, and owned actions.
Read the setup guideDon't see your workflow? Describe it.
A sentence or two about a recurring job is enough. We design the playbook that runs it and show you exactly what it saves.