Stage 7 · Master
Incident Response With AI
Drafting the Postmortem
Generating a blameless first draft with contributing factors and actions.
Postmortem Value
Postmortems capture lessons from incidents so they do not happen again. Writing them is valuable but time-consuming. An AI assistant can generate a first draft from the incident timeline, chat logs, and RCA analysis, giving the team a head start.
Generation Approach
def generate_postmortem_draft(incident, timeline, rca_result):
"""Generate a postmortem draft from incident data."""
context = f"""Incident: {incident['title']}
Severity: {incident['severity']}
Duration: {incident['duration']}
Services affected: {', '.join(incident['services'])}
Timeline:
{format_timeline(timeline)}
Root Cause Analysis:
{json.dumps(rca_result, indent=2)}"""
response = openai.ChatCompletion.create(
model="gpt-4-turbo",
temperature=0.3,
messages=[
{
"role": "system",
"content": """Write a blameless postmortem document.
Structure:
1. Summary — one paragraph describing the incident
2. Impact — user impact, duration, severity
3. Timeline — key events chronologically
4. Root Cause — what caused the incident
5. Contributing Factors — what made the impact worse
6. Resolution — how the incident was resolved
7. Action Items — prioritized list with owners and due dates
8. Lessons Learned — what we learned
RULES:
- Use blameless language. Describe system failures, not human failures.
- Use "we" not "someone should have".
- Focus on what can be improved in the system.
- Action items must be specific, measurable, and assigned."""
},
{"role": "user", "content": context}
]
)
return response["choices"][0]["message"]["content"]The generator uses the incident timeline and RCA as input, producing a structured draft ready for team review.
Blameless Language
| Blaming | Blameless |
|---|---|
| John forgot to update the config | The config was not updated during the deploy process |
| The team missed the alert | The alert did not surface in the primary notification channel |
| Someone pushed a bad commit | The code review process did not catch the regression |
Blameless postmortems focus on systemic improvements. People are still accountable for action items. The difference is that the focus is on fixing the system, not punishing the person.
Action Items
def generate_action_items(rca_result, incident):
"""Generate specific, measurable action items."""
response = openai.ChatCompletion.create(
model="gpt-4",
temperature=0.2,
messages=[
{
"role": "system",
"content": """Generate action items for this incident.
Each action item must have:
- title: specific, actionable description
- owner: team or role responsible
- priority: P1 (do now), P2 (this week), P3 (this month)
- due_date: specific date
- success_metric: how we know this is done
- type: prevent/detect/mitigate
Focus on systemic improvements, not one-off fixes."""
},
{"role": "user", "content": f"RCA: {json.dumps(rca_result)}\nIncident: {incident['title']}"}
]
)
return json.loads(response["choices"][0]["message"]["content"])Action items with owners, dates, and success metrics are more likely to be completed than vague action items.
Review Process
- AI generates the first draft from incident data.
- Incident commander reviews and corrects factual errors.
- Team reviews during the postmortem meeting.
- Action items are assigned with owners and due dates.
- Document is published to the postmortem repository.
- Action items are tracked in the project management tool.
The best postmortems are written while the incident is fresh. Have the AI generate a draft immediately, then refine it during the postmortem meeting.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.