pm

Incident Postmortem Generator

Create comprehensive incident postmortem documents by reading Slack incident channels and storing structured postmortems in Notion.

When to Use

• After resolving a production incident
• When conducting postmortem reviews
• When documenting incident responses for team learning
• To generate action items from incident discussions

Prerequisites

This skill requires the following MCP servers to be configured:

• Slack MCP - For reading incident channel history
• Notion MCP - For creating postmortem documents in the Notes database

Optional:

• Betterstack MCP - For including telemetry and uptime links

Process

1. Identify the Incident Channel

Ask the user for the Slack channel name or ID. The channel should be the dedicated incident channel (typically named like #incident-<name> or #inc-<date>-<description>).

2. Read Slack Channel History

Use the Slack MCP to fetch the channel's message history:

mcp__slack__slack_list_channels

Find the channel ID, then fetch history:

mcp__slack__slack_get_channel_history with channel_id

For threaded discussions, also fetch thread replies:

mcp__slack__slack_get_thread_replies with channel_id and thread_ts

Get user information to resolve mentions:

mcp__slack__slack_get_users

3. Analyze the Incident

From the Slack messages, extract:

1. Timeline: Key events in chronological order

   • When was the incident first detected?
   • When was it acknowledged?
   • What investigation steps were taken?
   • When was it mitigated/resolved?

2. Root Cause: The underlying technical issue

   • What broke?
   • Why did it break?
   • What dependencies were involved?

3. Impact: The effect on users/systems

   • What services were affected?
   • How many users impacted?
   • What was the duration?

4. Open Questions: Unresolved items from discussion

   • Unclear technical details
   • Areas needing further investigation
   • Decisions that need to be made

5. Action Items: Follow-up tasks with assignees

   • Preventive measures
   • Monitoring improvements
   • Documentation updates
   • Process changes

4. Generate Postmortem Document

Create a markdown document following this structure:

# Incident Postmortem: [Brief Title]

**Date:** [Incident Date]
**Severity:** [P0/P1/P2/P3]
**Duration:** [Total incident duration]
**Author:** [Person creating postmortem]

## Summary

[2-3 sentence summary of what happened and the impact]

## Timeline

| Time (UTC) | Event |
|------------|-------|
| HH:MM | Incident detected via [source] |
| HH:MM | Team alerted |
| HH:MM | Investigation began |
| HH:MM | Root cause identified |
| HH:MM | Mitigation deployed |
| HH:MM | Incident resolved |

## Impact

- **Services Affected:** [List of affected services]
- **Users Impacted:** [Number or percentage]
- **Duration:** [How long users were affected]
- **Data Loss:** [Yes/No, details if applicable]

## Root Cause Analysis

### What Happened

[Detailed technical explanation of the failure]

### Why It Happened

[Contributing factors, systemic issues]

### Detection

[How was the incident discovered? Could we have detected it sooner?]

## Telemetry & Monitoring

[If Betterstack MCP is available, include relevant links]

- **Uptime Dashboard:** [Link]
- **Error Metrics:** [Link]
- **Relevant Alerts:** [Link]

## Open Questions

- [ ] [Unresolved question 1]
- [ ] [Unresolved question 2]

## Action Items

| Action | Assignee | Priority | Status |
|--------|----------|----------|--------|
| [Action description] | @[username] | High/Medium/Low | Open |
| [Action description] | @[username] | High/Medium/Low | Open |

## Lessons Learned

### What Went Well

- [Positive aspects of incident response]

### What Could Be Improved

- [Areas for improvement]

## References

- **Incident Channel:** #[channel-name]
- **Related PRs:** [Links to fix PRs]
- **Related Docs:** [Links to relevant documentation]

5. Create Notion Page

Use the Notion MCP to create the postmortem in the Notes database:

First, search for the Notes database:

mcp__claude_ai_Notion__notion-search with query: "Notes"

Or use the Notion skill:

Skill: notion-search with "Notes database"

Then create the page with the postmortem content:

mcp__claude_ai_Notion__notion-create-pages with:
- parent: Notes database ID
- title: "Incident Postmortem: [Brief Title]"
- content: [Generated markdown content]

Important: Add the required tags to the page:

• eng
• postmortem

If the Notion MCP supports tags/properties, set them during creation. Otherwise, use the update page tool:

mcp__claude_ai_Notion__notion-update-page with:
- page_id: [created page ID]
- properties: { tags: ["eng", "postmortem"] }

6. Share Results

After creating the postmortem:

1. Provide the Notion page link to the user
2. Optionally post a summary back to the Slack channel:

mcp__slack__slack_post_message with:
- channel: [incident channel ID]
- text: "Postmortem document created: [Notion link]"

Tips for Quality Postmortems

Blameless Culture

• Focus on systems and processes, not individuals
• Use "the system failed to..." rather than "person X failed to..."
• Treat failures as learning opportunities

Be Specific

• Include exact timestamps when available
• Reference specific commits, PRs, or deployments
• Quantify impact with numbers when possible

Actionable Items

• Each action item should be specific and achievable
• Assign clear owners
• Set priorities to help with planning

Capture Context

• Include relevant Slack threads and discussions
• Link to monitoring dashboards and alerts
• Reference any related incidents

Output

Provide to the user:

1. Summary of what was extracted from Slack
2. Notion link to the created postmortem
3. List of action items for easy reference
4. Any gaps that need manual filling (if information was missing from Slack)