Incident Response Playbook for Engineering Teams

Create an incident response playbook for [COMPANY NAME], a [COMPANY TYPE] with [NUMBER] active users and [UPTIME]% SLA.\\\\\\\\n\\\\\\\\n**Context:**\\\\\\\\n- Engineering team: [NUMBER] engineers\\\\\\\\n- Stack: [TECHNOLOGY LIST]\\\\\\\\n- Support hours: [24/7 or BUSINESS HOURS]\\\\\\\\n- Recent incidents: [DESCRIBE 2-3 INCIDENTS]\\\\\\\\n\\\\\\\\n**1) Severity Classification:**\\\\\\\\n\\\\\\\\n| Level | Criteria | Example | Response SLA |\\\\\\\\n|-------|----------|---------|-------------|\\\\\\\\n| SEV1 — Critical | [Criteria] | [Example] | [Time] |\\\\\\\\n| SEV2 — High | [Criteria] | [Example] | [Time] |\\\\\\\\n| SEV3 — Medium | [Criteria] | [Example] | [Time] |\\\\\\\\n| SEV4 — Low | [Criteria] | [Example] | [Time] |\\\\\\\\n\\\\\\\\n**2) Detection and Escalation:**\\\\\\\\n- Automated alerts that trigger (Prometheus/Datadog/Sentry)\\\\\\\\n- Who gets notified by severity (on-call rotation)\\\\\\\\n- How to activate the Incident Commander (IC)\\\\\\\\n- Communication channels (dedicated Slack channel, bridge call)\\\\\\\\n\\\\\\\\n**3) Response Process (by severity):**\\\\\\\\n\\\\\\\\n**SEV1/SEV2:**\\\\\\\\n- Minute 0-5: IC takes over, creates channel #incident-YYYY-MM-DD\\\\\\\\n- Minute 5-15: Initial diagnosis (dashboards, logs, git blame recent deploy)\\\\\\\\n- Minute 15-30: Decision — rollback vs. hotfix vs. feature flag\\\\\\\\n- Every 30 min: Status update to stakeholders\\\\\\\\n- Resolution: verify with smoke tests before declaring resolved\\\\\\\\n\\\\\\\\n**4) Communication:**\\\\\\\\n- Internal message template (for the team)\\\\\\\\n- External message template (for customers — status page)\\\\\\\\n- Who approves external communication\\\\\\\\n- Update frequency by severity\\\\\\\\n- Status page channel (Statuspage.io, Instatus, or custom)\\\\\\\\n\\\\\\\\n**5) Postmortem (required for SEV1/SEV2):**\\\\\\\\n- Detailed incident timeline\\\\\\\\n- Root cause analysis (5 Whys)\\\\\\\\n- Contributing factors\\\\\\\\n- What went well\\\\\\\\n- Action items with owner and deadline\\\\\\\\n- Postmortem document template\\\\\\\\n- Review meeting (blameless — focus on systems, not people)\\\\\\\\n\\\\\\\\n**6) Runbooks by Scenario:**\\\\\\\\nCreate specific runbooks for:\\\\\\\\n- [SCENARIO 1: e.g. database out of space]\\\\\\\\n- [SCENARIO 2: e.g. API returning 500 errors globally]\\\\\\\\n- [SCENARIO 3: e.g. unexpected traffic spike]\\\\\\\\n- [SCENARIO 4: e.g. security breach]\\\\\\\\n\\\\\\\\nEach runbook: symptoms, diagnostic commands, resolution steps, who to call.\\\\\\\\n\\\\\\\\n**7) Incident Metrics:**\\\\\\\\n- MTTD (Mean Time to Detect)\\\\\\\\n- MTTR (Mean Time to Resolve)\\\\\\\\n- MTBF (Mean Time Between Failures)\\\\\\\\n- Incidents per month (trend)\\\\\\\\n- % of action items completed on time