Incident triage starter runbook

Purpose: reduce confusion in the first 15 minutes. Customize escalation contacts, severity definitions and rollback commands before use.

Intake

  1. Capture impact (customer groups, services, regions), first observed time (UTC), and known change window.
  2. Assign incident commander, technical lead, scribe and communications owner. Avoid posting secrets in tickets.
  3. Validate evidence from two independent signals, such as synthetic availability checks and server-side logs.

Stabilization

  1. Contain risky changes. Pause deployments only when warranted.
  2. Consult pre-approved rollback plan; do not improvise stateful database rollbacks.
  3. Preserve timestamps, immutable artifacts, traces and change identifiers.

Communication

Exit criteria

# Incident triage starter runbook

**Purpose:** reduce confusion in the first 15 minutes. Customize escalation contacts, severity definitions and rollback commands before use.

## Intake

1. Capture impact (customer groups, services, regions), first observed time (UTC), and known change window.
2. Assign incident commander, technical lead, scribe and communications owner. Avoid posting secrets in tickets.
3. Validate evidence from two independent signals, such as synthetic availability checks and server-side logs.

## Stabilization

1. Contain risky changes. Pause deployments only when warranted.
2. Consult pre-approved rollback plan; do not improvise stateful database rollbacks.
3. Preserve timestamps, immutable artifacts, traces and change identifiers.

## Communication

- Internal incident updates: severity, impact, mitigation, confidence level, next update time.
- External notifications: approved owner only; respect legal/security notification requirements.

## Exit criteria

- User-facing service recovered and verified; alert noise reduced.
- Follow-up issue owner and due date recorded; root-cause analysis follows with supporting evidence.