Incident Postmortem Generator

Purpose

Automatically generate a structured, blameless postmortem document from the context of a resolved incident investigation.

Principles

• Blameless: Focus on systems and processes, never individuals
• Evidence-based: Every claim backed by data (logs, metrics, timeline)
• Action-oriented: Every finding leads to a concrete action item

Procedure

Step 1: Gather incident context

From the current conversation and agent memory, extract:

• Incident ID, severity, duration, affected services, impacted users
• Timeline: issue start, detection, acknowledgment, mitigation, resolution
• Root cause and contributing factors

Step 2: Assess detection and response

Step 3: Five Whys analysis

Apply the 5 Whys technique to the root cause to identify systemic issues.

Step 4: Generate action items

For each finding, create a SMART action item with owner, priority, and due date. Categories: prevent recurrence, improve detection, improve response, improve resilience.

Step 5: Compile postmortem

Generate the full document with: executive summary, impact, timeline, root cause, Five Whys, detection assessment, what went well, what could be improved, action items, and lessons learned.

Sample output

Summary: payment-service returned HTTP 500 errors for 1h 23m due to OOM-killed pod. Root cause: memory leak in connection pool from release v2.14.0. Impact: ~340 failed transactions, 120 customers.

References

• Postmortem Culture: https://learn.microsoft.com/en-us/azure/well-architected/operational-excellence/mitigation-strategy
• Azure Resource Health: https://learn.microsoft.com/en-us/azure/service-health/resource-health-overview