Incident Postmortem Drafter
Incident channel chaos → structured postmortem draft.
role opsrole devdraftingreportingmonitoringintermediatefree planorigin selfupdated 2026-10-24
01Requires
what are these? skills vs memories vs plugins →
your postmortem template (timeline / impact / root cause / action items) memoriesblameless-writing rules: no names-as-causes, no 'should have known' memoriesthe incident channel export or pasted chat log permissions
02Setup — 6 steps
- 01Create the agent. Open Grok Bot → Agents → New Agent, name it
postmortem-drafter. - 02Paste the prompt. Copy the prompt below into the system field.
- 03Store two memories. Two memories: your postmortem section structure, and your blameless-writing rules.
- 04Feed the channel log. Export the incident channel or paste the relevant window of messages.
- 05Review the timeline. Timestamps are where it errs most — verify detection/response/resolve times by hand.
- 06Edit, don't adopt. The draft is a skeleton for the meeting, not the final document.
03Prompt
agent prompt · system field
You are a postmortem drafting agent. From the incident channel log produce:
- Timeline: detection, acknowledgment, mitigation, resolution — with timestamps cited to messages.
- Impact section: what users/systems were affected, stated only from what's in the log.
- Root cause draft: clearly marked DRAFT — engineers confirm or correct in the review.
- Action items: every 'we should…' in the log, normalized to owner-less checkbox lines.
- Write blameless per the memory rules. Any unverifiable claim gets '[verify]' not a guess.
04Config
| name | example | description |
|---|---|---|
channel log | #inc-2026-10-21 export | Paste or export — the messier the input, the more the structure helps |
blameless memory | "describe decisions, not deciders" | Tone rules that keep postmortems usable as documents |
05Sample output
Example output shape: 45-min incident → timeline (6 entries), impact draft, 4 action items.
06Pitfalls
Confident wrong timestamps. Every timeline entry must cite its source message — the prompt enforces it, but still spot-check.
Root cause stated as fact. Keep the DRAFT marker prominent. If the team starts accepting it unedited, rename it 'hypothesis'.
07Variants
- statuspage-update-drafter — customer-facing version during the incident
- oncall-handoff-digest — weekly version: incidents without full postmortems
- runbook-drift-checker — diffs postmortem action items against runbooks monthly
08FAQ
Can it pull from Slack directly?
With a Slack plugin or an export paste-in. Live-channel reading during an active incident is not the pattern — run it after resolution.
Does it write the final document?
It writes the skeleton the meeting edits. Treat output as scaffolding, not the record.
What about incidents spanning days?
Split the log by day and merge the timelines — long windows dilute the citation discipline.
09Run it — or hand it to us
Tell us what you want Grok Bot to do: hello@awayhand.com
10Related templates
Ticket Triage Router
Labels new tickets by severity and theme as they land.
support · ops · 2026-10-24
Bug Report Structurer
Messy bug reports in, structured tickets out.
dev · 2026-10-24
Release Notes Drafter
Merged PRs in — readable release notes out, weekly.
dev · 2026-10-24
Stakeholder Update Drafter
The week's tickets and incidents → Friday's update.
pm · 2026-10-24
↩Also referenced by
unofficial template from a community-run directory — not affiliated with the product's vendor · disclaimer
New templates as they land. No hype.
Email to subscribe →