Incident Postmortem Generator (Blameless RCA Report)
A blameless postmortem with timeline, metrics and action items, from your incident facts.
Try before you buy.
- Free preview: the computed times and error budget and the first two sections of the report, as pages marked “MySmartCoPilot preview · not for use”.
- Locked until you unlock it: download and copy.
- Unlock: Premium pass, ₹799 for 30 days or ₹249 for 1 week, a one-time payment that never renews. Unlock: Premium pass, $19.99 for 30 days or $7.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Incident
Severity definitions (your team’s)
Times and response metrics
When the impact began (often found afterwards, from graphs or logs).
When an alert fired or someone noticed.
When a responder took the incident on.
When the impact stopped for customers (a rollback, a failover).
When the incident was closed: the fix in place and monitoring normal.
Summary and impact
Two to four sentences someone outside the team can follow.
Timeline
From a chat, a log or your notes: each line that starts with a time (ISO 8601, a date and time, epoch seconds, a syslog stamp or a time of day on the Started date) becomes an entry; lines after it join it.
No entries yet.
Root causes and trigger
Detection and resolution
Action items
No action items yet. Each one has an owner and a type: prevent, detect, mitigate or process.
Types: Prevent, Detect, Mitigate, Process.
Lessons learned
Customer version
A shorter report for customers or a status page: no names, no internal detail. Empty fields fall back to the summary and the resolution.
Action items ticked “In the customer version” are listed under “What we are changing”.
Blameless-language check
Postmortems describe systems, not culprits: the check finds blaming words, people’s names and @handles in every section, the timeline and the action items.
The report
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the Incident Postmortem Generator (Blameless RCA Report)
Turn an incident into a postmortem your team can act on. Enter what happened — the severity, the services, the five times that matter (started, detected, acknowledged, mitigated, resolved) in the incident’s time zone, the impact, and your SLO — and the page works out time to detect, acknowledge, mitigate and resolve and how much of the error budget the incident used. Paste a raw timeline from a chat, a log or a Slack export and it becomes sorted, de-duplicated entries you can edit.
The report follows the sections of the example postmortem in Google’s Site Reliability Engineering book: summary, impact, root causes (with five whys and contributing factors), trigger, resolution, detection, action items with an owner, a type (prevent, detect, mitigate, process), a priority and a due date, lessons learned (what went well, what went wrong, where we got lucky), the timeline and supporting information. A blameless-language check finds blaming words, the names of the people you list and @handles in every section, and suggests the role to write instead. A shorter customer version leaves out names and internals.
Drafts stay in this browser; nothing is uploaded. Without a pass the result is a free preview: the report’s first pages with the metrics and its first two sections, marked “MySmartCoPilot preview · not for use”. The full report, the customer version and the PDF, Word, Markdown and CSV exports unlock with a Premium pass.
How to use it
- Fill in Incident: the title, the severity (edit the definitions to your team’s), the services and why the incident gets a postmortem. Example incident shows a finished one.
- Under Times and response metrics, choose the incident’s time zone and enter the five times; the metrics appear as you type, with a warning when two times are out of order. Add the SLO target to see the error budget used.
- Write the summary and the impact, then paste a raw timeline and press Read the timeline, or open a Slack channel’s export; edit, add or remove entries.
- Fill in the root causes, the five whys, detection, resolution, action items and lessons learned, list the people involved, and fix what the blameless-language check finds.
- Read the report beside the form. With a pass, download it as PDF, Word or Markdown, the action items as CSV for your tracker, and the customer version; the free preview shows the first pages with the metrics.
Examples
Started 14:02 · detected 14:09 · acknowledged 14:11 · mitigated 14:49 · resolved 15:30 · SLO 99.9 % over 30 days
Time to detect 7 min · to acknowledge 2 min · to mitigate 47 min · to resolve 1 h 28 min · 47 min of downtime used 108.8 % of the 43 min error budget
A 99.9 % SLO over 30 days allows 0.1 % × 30 × 1,440 = 43.2 minutes: this one incident spent more than the month’s budget.
14:09 Alert: checkout error rate above 5 % 14:11 Priya acknowledged and opened #inc-2041 (continued) checking the gateway dashboards 2:38 PM Queue time near the 5 s timeout
Three entries on the incident’s date, in order: 14:09, 14:11 (with the continued line joined) and 14:38.
Root causes: “Bob forgot to update the config and failed to test it.” · People: Bob = the release engineer
“Bob” → use the role “the release engineer” · “forgot to” → say which checklist step or reminder was missing · “failed to” → say what did not happen and why the system allowed it
Common uses
- Writing the postmortem of an outage while the facts are fresh, in the structure reviewers expect.
- Measuring how long detection, acknowledgement and mitigation took, and what the incident did to the error budget.
- Turning a chat channel or a log into a clean timeline instead of copying times by hand.
- Sending customers a short, factual incident report that leaves internal detail out.
The sections
The order and headings follow the example postmortem of the Site Reliability Engineering book (sre.google, Example Postmortem): a summary, the impact, the root causes, the trigger, the resolution, the detection, the action items, lessons learned (what went well, what went wrong and where we got lucky), the timeline and supporting information. The page adds an “At a glance” table of the times and metrics, the five whys and the contributing factors under the root causes, and the reasons the incident needed a postmortem. Sections you leave empty are left out of the report.
Response metrics and the error budget
- Time to detect = detected − started; time to acknowledge = acknowledged − detected; time to mitigate = mitigated − started; time to resolve = resolved − started. Averaged over many incidents these are the MTTD, MTTA, MTTM and MTTR of incident dashboards.
- The error budget is 100 % minus the SLO (sre.google, Implementing SLOs): for a time-based SLO, (1 − SLO) × the period. A 99.9 % SLO over 30 days allows 43.2 minutes. Budget used = downtime ÷ ((1 − SLO) × period). The downtime is the time from the start to mitigation unless you enter your own figure — for a partial outage, bad minutes weighted by the share of failing requests.
- Times are entered in the incident’s time zone and kept as exact instants, so a timeline pasted with UTC timestamps lines up with times entered in local time.
Writing it blamelessly
A blameless postmortem looks for the contributing causes in the system and the process and assumes everyone acted with good intentions on the information they had (sre.google, Postmortem Culture). The check flags words that judge people (careless, negligent, incompetent), hindsight (should have, obviously), blame (fault of, to blame, human error) and absent-mindedness put on a person (forgot to, ignored, failed to), plus the names of the people you list and @handles, and suggests what to write instead. It is a word list, not a judge: read each finding in its context (“the job failed to connect” is about a system).
Reading a raw timeline
A line that starts with a time starts an entry: ISO 8601 (2026-03-02T14:05:00Z, with or without a zone), a date and time (2026-03-02 14:05), epoch seconds or milliseconds, a syslog stamp (Mar 2 14:05:00) or a time of day such as 14:05, [14:05:30] or 2:05 PM, which takes the Started date (and the next day when the times go back past midnight). Lines without a time continue the entry before them. A Slack channel export is read from its JSON (each message’s ts, text and sender’s name; the names are added to the people list for the check). Entries are sorted, and repeats (the same minute and text) appear once.
Limitations
- The page writes what you enter and works out the metrics; it does not find the root cause for you or check your facts.
- The blameless check is a word list in English: it can miss blame written another way and flag a phrase that is about a system.
- Names are found only for the people you list (and Slack senders); spelled differently, they are missed.
- PDFs draw Latin, Greek, Cyrillic, Vietnamese and Devanagari letters; other scripts show as “?” there, and the Word file keeps them.
- Drafts are kept in this browser only: save a draft file to move it to another device.
Privacy
On this device: nothing is sent
Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.
Frequently asked questions
What do I get without a pass?
Without a pass, Incident Postmortem Generator (Blameless RCA Report) shows the computed times and error budget and the first two sections of the report, as pages marked “MySmartCoPilot preview · not for use”. Until you unlock it, the result can’t be downloaded or copied. A Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Is the incident uploaded?
No. The report is made in your browser and the draft is kept in this browser’s storage; a draft file you save stays on your device.
What is the difference between mitigated and resolved?
Mitigated is when customers stopped being affected (a rollback, a failover, a feature flag turned off). Resolved is when the incident was closed: the lasting fix is in place or scheduled and monitoring is back to normal. Time to mitigate is usually what customers felt.
Why does the error budget go above 100 %?
Because one incident can use more than a whole period’s budget: 47 minutes of downtime against a 99.9 % SLO over 30 days uses 108.8 % of its 43.2 minutes. Many teams then slow releases until the budget recovers.
Can I put names in the timeline?
Many teams write roles instead (“the on-call engineer”), so the review stays on the system. The check lists every name it finds, and Replace writes the role for you; leave a name where your team’s practice is to keep it.
Which tools read the action items’ CSV?
It has one row an item with summary, type, priority, owner, due date, ticket and incident columns, which issue trackers’ CSV imports can map to their own fields.