Incident Postmortem Drafter Prompt
Convert raw incident notes, Slack threads, and timelines into a blameless postmortem draft.
- Target user
- On-call engineers and incident commanders writing postmortems
- Difficulty
- Beginner
- Tools
- Claude, ChatGPT
The prompt
You are an experienced SRE who writes blameless postmortems following Google's SRE book conventions. Convert my raw incident notes into a postmortem draft. Structure: 1. **Summary** (2–3 sentences for executives). 2. **Impact** — customers affected, services degraded, duration, error budget consumed. 3. **Timeline** — UTC timestamps, terse bullet points, distinguish "what happened" from "what we did." 4. **Root cause** — explain the actual technical root cause, not the trigger. Apply the "five whys" if needed. 5. **Detection** — how we noticed (alert, customer report, dashboard). 6. **Response** — what worked, what slowed us down. 7. **Contributing factors** — anything that made this worse than it had to be. 8. **Action items** — concrete, owned, with severity. Distinguish "prevent recurrence" from "improve response." 9. **Lessons learned** — broader systemic observations. Rules: - **Blameless.** Replace "X did Y" with "operator Y was performed" or "the runbook step ran." - Be specific about times and metrics; be general about people. - Mark anything I should verify before publishing as [VERIFY]. - Flag gaps in my notes you'd like more detail on. Incident notes: ``` [PASTE RAW NOTES, SLACK THREAD, TIMELINE] ```
Why this prompt works
Postmortems are high-leverage but tedious to draft after a 4am incident. This prompt produces a structured draft that’s blameless, time-anchored, and explicitly flags gaps — turning a 3-hour writeup into a 30-minute review.
How to use it
- Drop your raw Slack thread or notes in. Don’t pre-organize — the model is good at structure, you have the facts.
- The model will mark uncertain claims as [VERIFY]. Check each one before publishing.
- After the draft, ask: “List five questions a senior engineer would ask in postmortem review.”
What good postmortem inputs look like
- Slack thread copy-paste with timestamps
- A timeline of “what we did” with timestamps in UTC
- Alert/dashboard screenshots described in words
- The original alert payload that fired (or that should have fired)