Template — Incident Review

Incident date/time:
Service(s):
Impact:
Status: Resolved / Monitoring / Open

Summary

Short factual description of user-visible impact and duration.

Use exact timestamps with time zones. Mark hypotheses as hypotheses.

How the issue was first detected and whether monitoring should have detected it earlier.

Explain technical/system conditions without assigning personal blame.

What restored service and how restoration was verified.

Tools, runbooks, alerts, architecture and communication.

Concrete owner, action and tracking reference. Separate immediate fixes from longer-term prevention.

List runbooks/reference pages that were created or updated because of this incident.