Incident Response Summary

The Challenge

After incidents, teams must document what happened, why, and how to prevent recurrence. Compiling this from alerts, Slack, and memory takes hours and often gets deprioritized.

The AI Desk Solution

AI Desk compiles incident postmortems from all sources automatically, ensuring complete documentation.

The Workflow

Step 1: Incident Resolved

Trigger: Incident marked resolved in PagerDuty
Sources: Alerts, Slack, metrics, runbooks

Step 2: Timeline Reconstruction

• Alert sequence
• Response actions
• Communication threads
• Resolution steps

Step 3: Postmortem Draft

📋 Incident Postmortem: INC-2847

INCIDENT SUMMARY
├── Title: API Latency Spike
├── Severity: P2
├── Duration: 47 minutes
├── Impact: 15% of API requests >2s
└── Detection: Datadog alert

TIMELINE
├── 14:23 Alert triggered (p95 > 2000ms)
├── 14:25 On-call acknowledged (Jamie)
├── 14:31 Root cause identified (DB locks)
├── 14:45 Mitigation applied (query kill)
├── 14:52 Metrics normalized
└── 15:10 All-clear communicated

ROOT CAUSE
Database lock contention from long-running
analytics query during peak hours.

WHAT WENT WELL
├── Fast detection (2 min)
├── Clear runbook followed
└── Good team communication

WHAT COULD IMPROVE
├── Analytics query not time-limited
├── No separate read replica for reports
└── Alert threshold could be tighter

ACTION ITEMS
├── Add query timeout for analytics
├── Evaluate read replica for reports
├── Update runbook with this scenario
└── Review alert thresholds

Value Proposition

• Time Saved: 2 hours per incident
• Complete Record: Nothing forgotten
• Better Prevention: Systematic learning