Compile system outage notes into a post-mortem report, verifying root causes before distribution
When a system outage occurs, operations managers must scramble to piece together timelines from multiple chat logs, ticket systems, and monitoring alerts, often leading to delayed reports or unverified root causes that get circulated to leadership.
- Before
- 120 min
- After
- 75 min
- Saved
- 45 min
How this used to go
- Gather incident logs, chat threads, and ticket updates from the support and engineering teams
- Reconstruct a chronological timeline of when the issue started, was detected, and was resolved
- Follow up with individual engineers via direct message to clarify conflicting notes on root causes
- Draft the summary report in a document template, synthesizing technical details into business impact
- Send the draft to department heads for review and revise based on their feedback before final distribution
Chasing down engineers to clarify vague troubleshooting notes while trying to build an accurate timeline under pressure.
The workflow, step by step
- You
1. Assemble the incident record
Export or copy the relevant monitoring alerts, chat threads, support tickets, deployment notes, and incident updates into one working set. Include timestamps, authors, and links or identifiers where available.
- AI
2. Build a sourced incident timeline
Give the working set to AI and ask it to order events by time, separate detection from response and resolution, and attach each claim to its source. It should flag missing timestamps, duplicate events, and contradictory notes instead of filling gaps with assumptions.
- AI
3. Separate evidence from root-cause hypotheses
Ask AI to group technical notes into observed symptoms, confirmed actions, possible causes, and unresolved conflicts. AI can identify which sources support each hypothesis, but it cannot independently verify a root cause from incomplete or conflicting notes.
- You
4. Confirm or reject the root cause
An engineering or operations owner must decide whether the evidence supports a confirmed root cause, a provisional cause, or no conclusion, and resolve key conflicts with the responsible engineers. If the cause is not verified, mark it as unconfirmed and hold distribution or clearly disclose the uncertainty.
- AI
5. Draft the post-mortem
Provide AI with the approved timeline, root-cause status, customer or business impact, response actions, and follow-up items. Ask it to produce the report in the required template while preserving source-backed facts and labeling open questions.
- You
6. Approve and distribute the report
The accountable operations owner checks that the report matches the approved facts, removes unsupported claims, and decides whether it is ready for leadership distribution. Send the final report only after that decision; otherwise return it for correction or further investigation.
What you end up with
Where this falls apart
- The input logs contain overlapping timestamps from multiple time zones without explicit UTC conversion, which causes the AI to construct an incorrect incident timeline.
- Engineering notes use heavy internal shorthand and ambiguous acronyms, which causes the AI to misinterpret troubleshooting steps and misclassify symptoms as root causes.