Create a Post-Incident Report

The Post-Incident Report builder is available to Advanced plan customers and lets you create a Post-Incident Report to document the incident postmortem process. This allows users to share key information and understanding about why an incident occurred, how resolvers responded, and what preventive actions can be taken to ensure it doesn't happen again.

Create a Post-Incident Report

Reports can be created once an incident is in the Resolved status. The incident owner or company supervisor can generate the report in the Incident Console.

To generate a Post-Incident Report:

  1. On the Incidents screen, click the Summary of the incident.
  2. In the top right corner of the Incident Console, click Create Post-Incident Report.
    • Once a Post-Incident report is created, the button changes to View Post-Incident Report.
  3. At the top of the report, you can edit the title and see when it was created, and when and who last updated it.
  4. Complete the report sections:

Post-Incident Report sections

The Post-Inclident report is split into the following sections:

Use this section to list the names of the report owner. The person who creates the Post-Incident Report is set as its owner, but ownership is transferable. Simply click Edit and select a new owner from the list.

The Analysis section is broken down into four text boxes to document key incident information:

Detail

Description

Impact

Add details about who was impacted by the incident, what their experience was, and how long the impact lasted.

Root Causes and Contributing Factors

 Include information about the cause of the incident, as well as any contributing factors.
Response and Resolution Add details about what was done to diagnose, mitigate, and resolve the incident.
Lessons Learned Include what went well, what could have gone better, and information on what can be done to prevent the same incident from reoccurring.

To edit these sections, click Edit and start typing. Once you've finished, click anywhere outside of the editing panel to automatically save your changes.

The timeline allows you to create a curated timeline for stakeholders. By default, it includes all the entries from the original timeline, but you can edit it to ensure only the most relevant moments of an incident's lifecycle and resolution process are captured. You can add, edit, or remove entries from the report timeline if extra information needs to be included that wasn't captured while the incident was occurring, or if details need to be modified to suit the audience.

To modify the timeline entries included in the report:

  1. Click Edit at the top of the timeline area.
  2. In the Edit Timeline screen, do any of the following:
    • To exclude an entry from the report, click the 'x' beside it in the Selected Entries area to move it to Available Entries.
    • To include an entry in the report, select the check box beside the entry in the Available Entries area to move it to Selected Entries.
    • To filter the entries in the Available Entries list, use the drop-down list to specify which type of entries you want to see, or type one or more search terms in the Search field to display only the entries that include those terms.
    • To sort the entries, click th drop-down menu and select Oldest First or Newest First.
    • To add a Note to the timeline, click New Entry above the Selected Entries list. It will appear chronologically based on the timestamp.

The Actions panel lets you assign follow-up tasks to other xMatters users and track the progress by adding a description, external ticket link, and target date.

To create an action:

  1. At the top of the Post-Incident Report, click the Actions tab.
  2. Click Add Action.
  3. Add a title, description, and an optional external ticket link/label.
  4. Choose an xMatters user or group to assign the action to by typing their name in the search bar.
  5. Select an optional target date using the calender.
  6. Click Save to create the action.

Currently actions can only be assigned to xMatters users. When a user is assigned an action, their name is displayed under the Assignee column of that action, but they aren't notified.

To manage post-incident actions:

  1. Click the Actions tab on the Post-Incident report.
  2. In the Actions list, do any of the following:
    • To update the status of an action, select a new status from the corresponding drop-down menu.
    • To update the Name, Description, Target Date, Links, or Assignees of an action, click the name of the action you want to edit.
    • To delete an action, click the name of the action you want to remove, and click Delete.
    • To sort the actions list, click any of the column headings to arrange them by status, name, target date, or assignees.
    • To search and filter for specific actions, click the search bar and type the name, description, or link of the actions you want to see.

Overdue post-incident actions

To help you keep track of their progress, any overdue actions are automatically flagged with a red target date and moved to the top of the list:

Report permissions

Only incident owners or company supervisors can create a Post-Incident Report or edit report owners. However, once a report is created, the report owner can be changed to any xMatters user by the current report owner, their supervisor, or a company supervisor. Any authenticated xMatters user can edit or view the report.

To change the Post-Incident Report owner:

  1. Under the Roles section, click Edit.
  2. Type the name of the xMatters user to find and select them from the list.
  3. Click Update.