Reference
Postmortem Template
Record what the vendor reported, what your application experienced, and what your team will change. Download the Markdown file or copy the template below.
Preview and copy the Markdown template
postmortem.md
# Incident postmortem: [Title]
**Date:** YYYY-MM-DD
**Owner:** [Name]
**Status:** Draft / Reviewed
**App impact window:** [Start and end, with UTC offset]
## Summary
[What happened, which users were affected, and how service recovered.]
## Evidence
### Vendor report
- Source URL: [Link]
- Products and regions covered: [Details]
- Reported start / resolution: [Timestamp or unknown]
- Last checked: [YYYY-MM-DD HH:mm UTC+00:00]
### Application observations
- Requests, logs or traces: [Links and measurement windows]
- Observed failures and duration: [Measured values or unknown]
- Affected user journeys: [Evidence, scope and limitations]
- Other changes during the window: [Deployments, configuration, traffic]
Keep vendor reports separate from observed application impact.
## Timeline
Include dates and UTC offsets, including when the incident spans midnight.
| Timestamp | Observation or action | Source |
| --- | --- | --- |
| YYYY-MM-DD HH:mm UTC+00:00 | [First observed problem] | [Link] |
| YYYY-MM-DD HH:mm UTC+00:00 | [Mitigation applied] | [Link] |
| YYYY-MM-DD HH:mm UTC+00:00 | [Recovery verified] | [Link] |
## Cause and recovery
- Confirmed cause: [Evidence, or state that it is unknown]
- Contributing conditions: [What made the impact possible]
- Mitigation: [Action and owner]
- Recovery check: [How recovery was measured]
- Remaining uncertainty: [What still needs investigation]
## SLA review, if relevant
- Vendor product and plan: [Details]
- Applicable terms and deadline: [Link and full date/time]
- Eligibility: Not assessed / Terms reviewed / Claim submitted
- Supporting evidence: [Links]
A vendor incident alone does not establish SLA eligibility.
## Follow-up actions
| Action | Owner | Due date | Verification |
| --- | --- | --- | --- |
| [Specific improvement] | [Name] | YYYY-MM-DD | [How completion is checked] |
## Lessons
- What helped detection and recovery?
- What slowed the response?
- What should change in the runbook or architecture?
Fill in the review
- Separate the sources
- Link the vendor report and your application observations separately.
- Use full timestamps
- Include the date and UTC offset so another team can follow the timeline.
- Assign the next action
- Give each follow-up an owner, due date and way to verify completion.
- State what remains unknown
- Separate confirmed causes from hypotheses and record the investigation still needed.
Keep the evidence clear
Use source timestamps and measured application behavior to support your incident review.