Question 1

What is an incident timeline and why is it important for post-mortems?

Accepted Answer

An incident timeline is a chronological record of every action taken during an IT incident - from initial detection through resolution. It is essential for post-mortems because it reveals gaps in response, identifies bottlenecks, and provides an objective record that teams can use to improve future incident handling and reduce mean time to recovery.

Question 2

How do you calculate time to detect, mitigate, and resolve an incident?

Accepted Answer

Time to detect (TTD) is measured from when the incident began to the first detection event. Time to mitigate (TTM) is from the start to the first mitigation action. Time to resolve (TTR) is the total duration from the incident start to the final resolution entry. These metrics help teams benchmark and improve their incident response processes.

Question 3

What categories should be tracked in an incident response timeline?

Accepted Answer

Effective incident timelines track six key categories: Detection (alerts, monitoring triggers), Investigation (root cause analysis, log review), Mitigation (temporary fixes, workarounds), Communication (stakeholder updates, status pages), Resolution (permanent fixes, deployments), and Follow-up (post-mortem scheduling, action items). Categorizing entries this way reveals which phases consume the most time.

Incident Timeline Builder

Incident Details

Add Timeline Entry

Timeline

Summary

Related Pages