Engineering Incident Report Summary Prompt

Incident Report Summary Prompt

Timeline, Root Cause, Impact, Next Steps — post-mortem summaries where the sequence stays chronological and the severity stays as written.

Overview

Incident summaries fail dangerously: a reordered timeline implies the wrong cause, an upgraded severity rewrites history. This setup summarizes incident reports into the four sections a post-mortem needs — Timeline (chronological, timestamps preserved), Root Cause (as stated, or "under investigation"), Impact (numbers as written), Next Steps — under Strict Fidelity with Preserve Critical Quotes, so impact figures and severity language keep their exact wording. The reading guidance pins the two rules that matter: keep events in order, and take severity from the report, not your judgment.

How to use this resource

  1. Summarize after the report stabilizes

    Run it on the written report, not the live channel — the fidelity rules assume a source that holds still.

  2. Check the Root Cause honesty

    "As stated — or 'under investigation' if unstated" — the section never speculates, which is exactly what a blameless review needs.

  3. Keep numbers verbatim

    Affected-user counts and durations are critical quotes: preserved exactly, never rounded into a different incident.

Why This Works

  • Chronology preservation stops the summary from implying a different causality
  • "Under investigation" as a legal value keeps unknowns honest
  • Strict fidelity plus critical quotes protects the numbers everyone will quote later

Best for

  • Engineering teams running blameless post-mortems
  • Incident channels that produce sprawling reports
  • Summaries that feed status pages and exec updates

Not for

  • Live incident triage — this summarizes the report, it doesn't respond to the incident
  • Classifying incident severity — severity is extracted as stated, never assigned

Use cases

  • Preparing post-mortem review summaries from long incident docs
  • Keeping timelines chronological with timestamps intact
  • Quoting impact numbers instead of approximating them

FAQ

What sections does the incident report summary prompt produce?

It builds four fixed markdown sections in order — ## Timeline (chronological, timestamps kept), ## Root Cause (as stated or 'under investigation'), ## Impact (numbers as written), and ## Next Steps — then appends ## Action Items as owner — task — deadline bullets. Each section runs 2-4 sentences, and any section with no source support reads 'Not covered in the source'.

How is this different from an executive or general summary?

It is incident-shaped rather than point-first. A general or Executive Summary prompt leads with the takeaway for a reader who won't open the source; this one holds the Timeline in chronological order, reports Root Cause exactly as stated, keeps Impact figures verbatim under Preserve Critical Quotes, and lists Next Steps — so the causality and the numbers survive intact.

When should I not use this incident summary prompt?

Skip it during live triage — it compresses a written report after the fact, and its fidelity rules assume a source holding still, so it can't track an unfolding incident. Don't reach for it to assign severity either: the rule 'severity language must come from the report, not your judgment' means severity is copied as written, never rated. Run it in ChatGPT, Claude, or Gemini once things stabilize.

More resources from Structured Summary Prompt

Resources that pair well

Related tools

Workflows that use this resource

Guides for this resource

Tip: Save time by exploring related resources and tools that integrate with this resource.