Blame
|
1 | # Incident Response |
||||||
| 2 | ||||||||
| 3 | Incidents should optimise first for safe restoration, then for understanding and prevention. |
|||||||
| 4 | ||||||||
| 5 | ## Lifecycle |
|||||||
| 6 | ||||||||
| 7 | 1. **Detect and scope** — identify the user-visible impact and affected systems. |
|||||||
| 8 | 2. **Stabilise** — stop further damage; prefer a known-good rollback when appropriate. |
|||||||
| 9 | 3. **Recover** — restore the service and verify from the user's perspective. |
|||||||
| 10 | 4. **Preserve evidence** — keep relevant logs, timestamps, deploy IDs and configuration diffs. |
|||||||
| 11 | 5. **Review** — document contributing conditions and follow-up actions without blame. |
|||||||
| 12 | 6. **Improve** — implement fixes, monitoring and documentation changes. |
|||||||
| 13 | ||||||||
| 14 | ## Communication |
|||||||
| 15 | ||||||||
| 16 | Use exact times with time zones for material events. Distinguish confirmed facts from hypotheses. Never paste secrets into incident pages. |
|||||||
| 17 | ||||||||
| 18 | Use [[Templates/Incident-Review]] for the durable record and create or update a runbook when the incident revealed a repeatable recovery procedure. |
|||||||