Step by step
1
Stabilize first
If the incident is active, follow the operating runbook and contain harm before writing the narrative. Do not let retrospective automation delay recovery.
2
Define the incident window
Record the earliest known symptom, latest known good state, affected system or customer, and the timezone. Search a slightly wider window to capture precursor events.
3
Collect visible events
Search exact errors, app names, terminal windows, ticket IDs, deployment identifiers, and meeting terms. Preserve the original source app and time for each event.
4
Build three lanes
Put directly observed events in facts, interpretation in inferences, and missing or conflicting state in unknowns. Correlation is not a proven cause.
5
Verify against authoritative systems
Check service logs, release artifacts, Sentry, billing, CRM, database, or account state as appropriate. State clearly when Screenpipe history is the only available source.
6
Remove sensitive material
Replace tokens, customer payloads, private messages, and personal data with narrow summaries or secure artifact references.
7
Publish the reviewed note
Include impact, timeline, confirmed cause if known, recovery, unresolved risk, owners, and follow-up dates. Do not claim resolution without a current system read-back.