Incident Postmortem Generator
Create structured, blameless postmortem documents following Google SRE best practices.
Incident Details
What is an Incident Postmortem?
An incident postmortem (also called a post-incident review) is a structured document created after a service disruption to analyze what happened, why it happened, and how to prevent recurrence. The goal is learning, not blame. Blameless postmortems focus on systemic failures—processes, tools, and safeguards that failed—rather than individual mistakes. This approach encourages honest reporting and leads to more effective preventive measures.
SRE teams, DevOps engineers, and engineering managers use postmortem templates to ensure consistent, thorough incident analysis across their organization. A well-structured postmortem includes a timeline of events, root cause analysis, contributing factors, what went well during response, what went wrong, concrete action items with owners and deadlines, and lessons learned. Companies like Google, Netflix, and Etsy have published their postmortem practices, establishing industry standards that this generator follows.
Frequently Asked Questions
What should be in an incident postmortem?
A comprehensive postmortem includes: incident summary (what happened, severity, duration), customer impact, a detailed timeline from detection to resolution, root cause analysis, contributing factors, what went well during response, what could be improved, specific action items with owners and due dates, and lessons learned. The timeline should be factual and precise, based on logs and communication records rather than memory.
How long after an incident should you write a postmortem?
Write the postmortem within 24-48 hours while events are fresh in everyone's memory. Start with the timeline immediately after resolution (often during the incident channel wrap-up), then schedule a postmortem review meeting within 2-5 business days. The review meeting should include all responders and relevant stakeholders to validate the timeline, agree on root cause, and assign action items.
What is the difference between RCA and postmortem?
Root Cause Analysis (RCA) is one component of a postmortem focused specifically on identifying why the incident occurred. A postmortem is the broader document that encompasses the full incident lifecycle including detection, response, resolution, impact assessment, and prevention planning. Modern SRE practice often prefers "contributing factors" over a single "root cause" since complex system failures rarely have one isolated cause.