Draft an incident timeline from alerts and error evidence
Bring incident records and telemetry into a source-linked postmortem draft with uncertainty preserved.
Target user
On-call engineers and incident commanders who reconstruct events after production incidents.
Trigger
An incident is resolved and the team needs a reviewable timeline and postmortem draft.
Why run it repeatedly
After each incident that requires a postmortem. Team incident volume and documentation effort should be measured in a pilot.
What you receive
A timestamped incident timeline, impact/evidence links, unresolved questions, and a blameless postmortem draft.
Pain evidence
First-person SRE/DevOps discussions describe manual updates across incident tools and reconstructing postmortems. One report includes vendor participation; independent recurrence and product gap need interviews.
Alternatives and remaining gap
PagerDuty, incident.io, Rootly, and similar products manage incident timelines natively. A deterministic export/template may be more reliable when all sources are integrated. AI helps reconcile prose and draft a readable account, not establish cause.
Execution flow
- Fetch the chosen PagerDuty incident and activity records; normalize every timestamp to UTC.
- Search Sentry in an operator-approved incident window and include only events with matching project/service and explicit evidence.
- Build a timeline that distinguishes observed events, operator recollection, and inferred sequence; annotate source URLs.
- Flag gaps, contradictory timestamps, and correlation-only observations; do not assign root cause.
- Draft a postmortem in preview and wait for incident commander approval before writing to Notion.
Required tools
- PagerDuty: browse_incidents, browse_activity, browse_change_events
- Sentry: search_errors, search_logs, search_traces, get_sentry_resource
- Notion: notion-search, notion-create-pages (after approval)
Prerequisites and costs
PagerDuty incident read access; Sentry project access and instrumentation; Notion workspace; client supports chaining and citation review. Plans, permissions, and data retention policies apply.
Run this prompt
Prepare a draft postmortem for PagerDuty incident [ID] using PagerDuty and Sentry evidence from [UTC window]. Normalize timestamps. Cite every event. Label operator statements separately from telemetry. Do not infer causation from time proximity and do not assign blame. Show gaps and conflicts; do not create a Notion page until approved.
Review checkpoints
Incident commander verifies impact, timestamps, customer communications, causal claims, and sensitive information. Human authors approve the final postmortem.
Limitations
MCP does not capture missing Slack/chat updates or human observations unless separately supplied. Incident tools and postmortem products already automate parts of this. Logs may be sampled or delayed; temporal correlation is not root cause.
Manual work and missing capabilities
Add Slack/Zoom or other responder notes not represented in PagerDuty/Sentry, validate customer impact, agree on a postmortem template, and approve the final document.
Failure handling
Use bounded retries for read failures and mark partial results incomplete. Keep source record IDs and links. Do not guess across missing or conflicting identifiers. Search for an existing target record before any approved write, then retrieve it to verify.
Pilot acceptance criteria
Every timeline row links to a source or is labeled recollection; UTC conversions are correct; conflicting events remain visible; no unsupported root cause or blame statement; no write before approval.
Product fit
Recipe only for now. Consider an installable package only if teams lack existing incident automation and need durable cross-source capture.
Demo storyboard
Use a synthetic incident with one alert, two matching errors, and a time-zone discrepancy; show the normalized, cited timeline and explicit uncertainty.
Official sources
Pain reported by users; official tool docs/catalog checked; workflow not runtime tested
