阅读中文版本

Incident Timeline Reconstruction Workflow

Rebuild a precise incident timeline from alerts, deploys, and chat so the postmortem rests on facts rather than memory.

Overview

Reconstruct an evidence-based timeline of what happened, when, and what was done.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• Alert history
• Deployment records
• Incident chat logs

Procedure

1. Gather evidence sources

Collect alert timestamps, deploy events, and the incident chat transcript.

Expected state: All evidence sources are in one place.

2. Normalise to a single clock

Convert all timestamps to one timezone and correlate related events.

Expected state: Events line up on a single timeline.

3. Identify causal sequence

Mark detection, escalation, mitigation, and resolution points with evidence.

Expected state: The timeline shows what triggered what.

4. Review for accuracy

Have responders validate the timeline and correct gaps before the postmortem.

Expected state: The timeline is agreed as accurate.

jq -r '.events[] | "\(.time) \(.source) \(.what)"' incident.json | sort

Verification

Confirm every timeline entry cites a source and responders agree the sequence is accurate.

Decision points

Include speculation about causes?

• Keep facts and hypotheses separate
• Mix them

Recommendation: Separate observed facts from hypotheses so the timeline stays trustworthy.

How granular?

• Match decisions and state changes
• Every message

Recommendation: Capture decision and state-change points; too much detail obscures the story.

Common failures

• Relying on memory produces a biased timeline.
• Mixed timezones create false causality.
• Over-granular timelines hide the key moments.