# Draft an incident timeline from alerts and error evidence
> Bring incident records and telemetry into a source-linked postmortem draft with uncertainty preserved.
Canonical: https://www.mcpfolio.com/workflows/incident-timeline-postmortem-draft
## Target user

On-call engineers and incident commanders who reconstruct events after production incidents.

## Trigger

An incident is resolved and the team needs a reviewable timeline and postmortem draft.

## Why run it repeatedly

After each incident that requires a postmortem. Team incident volume and documentation effort should be measured in a pilot.

## What you receive

A timestamped incident timeline, impact/evidence links, unresolved questions, and a blameless postmortem draft.

## Pain evidence

First-person SRE/DevOps discussions describe manual updates across incident tools and reconstructing postmortems. One report includes vendor participation; independent recurrence and product gap need interviews.

## Alternatives and remaining gap

PagerDuty, incident.io, Rootly, and similar products manage incident timelines natively. A deterministic export/template may be more reliable when all sources are integrated. AI helps reconcile prose and draft a readable account, not establish cause.

## Execution flow

1. Fetch the chosen PagerDuty incident and activity records; normalize every timestamp to UTC.
2. Search Sentry in an operator-approved incident window and include only events with matching project/service and explicit evidence.
3. Build a timeline that distinguishes observed events, operator recollection, and inferred sequence; annotate source URLs.
4. Flag gaps, contradictory timestamps, and correlation-only observations; do not assign root cause.
5. Draft a postmortem in preview and wait for incident commander approval before writing to Notion.

## Required tools

- PagerDuty: browse_incidents, browse_activity, browse_change_events
- Sentry: search_errors, search_logs, search_traces, get_sentry_resource
- Notion: notion-search, notion-create-pages (after approval)

## Prerequisites and costs

PagerDuty incident read access; Sentry project access and instrumentation; Notion workspace; client supports chaining and citation review. Plans, permissions, and data retention policies apply.

## Run this prompt

```text
Prepare a draft postmortem for PagerDuty incident [ID] using PagerDuty and Sentry evidence from [UTC window]. Normalize timestamps. Cite every event. Label operator statements separately from telemetry. Do not infer causation from time proximity and do not assign blame. Show gaps and conflicts; do not create a Notion page until approved.
```

## Review checkpoints

Incident commander verifies impact, timestamps, customer communications, causal claims, and sensitive information. Human authors approve the final postmortem.

## Limitations

MCP does not capture missing Slack/chat updates or human observations unless separately supplied. Incident tools and postmortem products already automate parts of this. Logs may be sampled or delayed; temporal correlation is not root cause.

## Manual work and missing capabilities

Add Slack/Zoom or other responder notes not represented in PagerDuty/Sentry, validate customer impact, agree on a postmortem template, and approve the final document.

## Failure handling

Use bounded retries for read failures and mark partial results incomplete. Keep source record IDs and links. Do not guess across missing or conflicting identifiers. Search for an existing target record before any approved write, then retrieve it to verify.

## Pilot acceptance criteria

Every timeline row links to a source or is labeled recollection; UTC conversions are correct; conflicting events remain visible; no unsupported root cause or blame statement; no write before approval.

## Product fit

Recipe only for now. Consider an installable package only if teams lack existing incident automation and need durable cross-source capture.

## Demo storyboard

Use a synthetic incident with one alert, two matching errors, and a time-zone discrepancy; show the normalized, cited timeline and explicit uncertainty.

## Evidence

Pain reported by users; official tool docs/catalog checked; workflow not runtime tested

## Required MCPs

- [PagerDuty MCP](https://www.mcpfolio.com/servers/pagerduty-hosted-mcp): Retrieves incident metadata, activity, and change events.
- [Sentry MCP](https://www.mcpfolio.com/servers/sentry): Adds time-bounded error, log, and trace evidence.
- [Notion MCP](https://www.mcpfolio.com/servers/notion): Stores the reviewed postmortem draft.

## Official sources

- [Engineer reports manual cross-tool incident updates](https://www.reddit.com/r/devops/comments/1ochlt7/)
- [Teams discuss documenting incidents and postmortems](https://www.reddit.com/r/devops/comments/vnxcen/)
- [PagerDuty MCP docs](https://support.pagerduty.com/main/docs/pagerduty-mcp-server)
- [Sentry MCP docs](https://mcp.sentry.dev/)
- [Notion MCP docs](https://developers.notion.com/guides/mcp/overview)


## Related

- [All workflows](https://www.mcpfolio.com/workflows)