Similar Past Incidents Finder Prompt
During or after an incident, mine your postmortem archive for prior incidents with the same fingerprint — symptoms, service, root cause family — so you reuse known mitigations instead of rediscovering them.
- Target user
- On-call engineers and SREs triaging incidents against historical patterns
- Difficulty
- Intermediate
- Tools
- Claude, ChatGPT
The prompt
You are an SRE who treats the postmortem archive as a search index, not a graveyard, and routinely shortcuts triage by recognizing "we've seen this before." I will provide: - The current incident's symptoms (alerts firing, error signatures, affected service, observable behavior) - A corpus of past postmortems/incident records (or a representative sample) - The fields available per record (title, summary, root cause, mitigation, services, tags) Your job: find and rank prior incidents that resemble the current one, and extract what's reusable. 1. **Build a fingerprint** — distill the current incident into a structured signature: primary symptom, affected service(s) and dependencies, error class, time pattern (spike/slow-burn/correlated-with-deploy), and blast radius. This is what you'll match on. 2. **Match dimensions** — score past incidents on symptom similarity, same service or shared dependency, same root-cause family, and same trigger (deploy, config change, traffic, vendor). Weight root-cause family and shared dependency highest; identical symptoms with different causes are a trap. 3. **Rank and explain** — return the top 3-5 matches with a similarity score and a one-line "why this matches." Be explicit about confidence and what's different, so the responder doesn't over-anchor on a false twin. 4. **Extract reusable mitigations** — for the strongest matches, pull the mitigation that worked, the rollback/runbook used, and any "this looked similar but wasn't" warnings recorded in those postmortems. 5. **Recurrence signal** — if the same root-cause family shows up repeatedly, flag it loudly: this is a systemic problem masquerading as a series of incidents, and the real fix is a remediation, not another mitigation. 6. **Guardrail against false confidence** — list the specific things to verify before applying a past mitigation, since "same symptom, different cause" can make a known fix actively harmful. Output as: the current-incident fingerprint, a ranked match table (score, why, what differs), the reusable mitigation per match, and a recurrence callout if present. Bias toward precision over recall — one well-justified match beats five vague ones.
Run this prompt with AI
Test it, get an AI-improved version, or compare models — live in the Prompt Workspace. No copy-paste.
Related prompts
-
OOMKilled Memory Exhaustion Live Incident Triage Prompt
Drive a fast, structured triage of a production memory-exhaustion incident — pods getting OOMKilled, hosts thrashing swap, the JVM/Node heap climbing — so the on-call separates a genuine leak from a load spike or a bad limit and picks the right mitigation without guessing.
-
p99 Tail Latency Spike Live Incident Diagnosis Prompt
Diagnose a live tail-latency incident where p99/p95 has spiked while averages look fine — separating a slow dependency, saturation, GC/lock contention, a hot shard, or a retry storm — so the on-call finds the real source instead of chasing green median dashboards.
-
First-Alert Triage & Hypothesis Ranking Prompt
Take a freshly fired alert plus a snapshot of metrics, logs, and recent changes, and produce a ranked list of failure hypotheses with the cheapest next diagnostic step for each — without taking any action on the system.
-
DNS Resolution Failure Live Diagnosis Prompt
Walk on-call through diagnosing a live DNS-related outage — resolver, authoritative, caching, and propagation layers — to find where name resolution is actually breaking before you start changing records.
More Incident Response prompts & error guides
Browse every Incident Response prompt and troubleshooting guide in one place.
Reading prompts? Get all 500 in one free PDF
500 battle-tested, copy-paste AI prompts engineered by a senior systems engineer — every one with fill-in placeholders and safety/back-out notes. Drop your email and it's yours.
- 500 prompts: Linux · Kubernetes · Terraform · OpenStack · GitLab · Docker · Monitoring · Incident Response
- Instant PDF download — yours free, forever
- Plus one practical AI-workflow email a week (no spam)
Single opt-in · unsubscribe anytime · no spam.