4.3Writing Incident Reports

The incident report is the permanent record of what happened. It is written after the incident is resolved and serves as the input for the root cause analysis.

Incident Report Template

# Incident Report: [Title]
Date: [Date]
Duration: [Start time] -- [End time] ([total duration])
Severity: [Sev-1/2/3]
Author: [Name]

## Summary
A 2-3 sentence summary of what happened, who was impacted,
and how it was resolved.

## Impact
- **Users affected:** [number and description]
- **Duration:** [time]
- **Revenue impact:** [if applicable]
- **Data impact:** [if applicable]
- **SLA impact:** [if applicable]
- **Support tickets generated:** [number]

## Timeline

| Time (UTC) | Event | Source |
|---|---|---|
| 14:00 | Alert triggered: DB connection pool at 90% | PagerDuty |
| 14:05 | On-call engineer acknowledged | PagerDuty |
| 14:12 | Checkout failures reported by users | Zendesk |
| 14:15 | Incident declared as Sev-1 | Slack #incidents |
| 14:15 | War room opened | Slack #inc-20260209 |
| 14:25 | Root cause identified: slow query | DB monitoring |
| 14:30 | Slow query killed, pool recovering | Manual action |
| 14:35 | Checkout functionality restored | QA verification |
| 14:45 | Database index deployed | Deploy pipeline |
| 15:00 | All-clear declared | Slack #incidents |

## Resolution
What was done to resolve the incident. Both the immediate fix
and any temporary measures.

## Root Cause
Brief description (full analysis in separate RCA document).

## What Went Well
- Alert triggered within minutes of the issue starting
- Root cause identified quickly through database monitoring
- Cross-team coordination was effective
- QA verified the fix before declaring all-clear

## What Could Be Improved
- Migration failure was not detected 2 weeks ago
- Staging data does not match production volumes
- No circuit breaker on database connection pool
- Status page was updated 10 minutes late

## Action Items
Link to the RCA corrective actions.

## Related Documents
- [Root Cause Analysis](link)
- [Status page timeline](link)
- [Customer communication](link)