Incident Timeline Builder
Assemble a clean, timestamped incident timeline from scattered logs, alerts, deploys, and chat. Use during or after an incident when building a postmortem, status update, or time-to-detect / time-to-recover numbers.
Copy the file into your agent runtime. Cursor loads personal skills from ~/.cursor/skills/incident-timeline/SKILL.md and project skills from .cursor/skills/incident-timeline/SKILL.md. Claude Code looks in .claude/skills/incident-timeline/SKILL.md.
Incident Timeline Builder
When to use
Raw signals (PagerDuty, deploy logs, Slack, status pages) need to become one ordered narrative. Triggers: build the incident timeline, what happened in order, compute TTD/TTR.
What it does
Normalizes every event to UTC, orders by timestamp, labels source and actor, and produces a table plus a short narrative of detection, diagnosis, mitigation, and recovery.
Steps
- Collect all timestamped signals; convert to UTC. Keep the original timezone in a note if conversion is ambiguous.
- Deduplicate repeated alerts into a single row with a count.
- Tag each event:
detect,diagnose,mitigate,recover, orcomms. - Compute TTD (first symptom → first human ack) and TTR (first symptom → recovery).
- Emit the timeline table, then a 4-sentence narrative, then the two metrics.
Output
| UTC | Source | Actor | Tag | Event |
|---|
Then: narrative (4 sentences). Then: TTD= and TTR= with the arithmetic shown.
Guardrails
Do not infer causation the logs do not support — describe sequence, not blame. If timestamps conflict across sources, keep both and note the discrepancy rather than silently picking one. Never invent an ack time.