Incident Timeline Template: The 5 Timestamps Every Postmortem Needs

Every postmortem fight starts the same way: someone scrolls back through the group chat trying to reconstruct what happened, and two people disagree about when the alerts first fired. The whole review stalls on archaeology. The fix takes one page and five timestamps, written during the incident instead of after it.

Why "we'll reconstruct it later" never works

At 2am nobody is taking clean notes. Messages get edited, threads fork, and by the time the postmortem runs, the timeline is a negotiation. The five timestamps below take seconds each to write down while they're true — and they're the only facts a review actually needs to start.

The five timestamps

  1. Detect — the moment anyone noticed. Not when the alert fired; when a human first looked at it. The gap between those two is your alerting reality, not your alerting plan.
  2. Declare — one sentence, out loud. "I'm declaring an incident: what we see, when we first saw it, I'm running this until someone takes over." If nobody declared, the timeline starts at the first message that reads like a declaration, and that's a finding.
  3. Mitigate — first action that reduced impact. The rollback, the feature flag, the restart. If you can't point to one, the outage length equals the root-cause hunt, and that's a finding.
  4. Resolve — back to normal, verified. Not "we think it's fine" — the check you ran that proved it. No verify step means the postmortem starts with a heated debate.
  5. Notify — each stakeholder message, sent. Customers, the boss, the team. Timestamped, so comms latency becomes a number instead of a feeling.

    6. The one-line format

    One channel, one thread, append-only. Each entry is a single line:

    [HH:MM] <name> <event> — <evidence>

    Example: [02:41] Ana MITIGATED — rolled back checkout build 4312; error rate 14% → 2%. The evidence half is what makes the line trustworthy at review time.

    Where it goes wrong in practice

    • The log lives in DMs. If the timeline isn't in the incident channel, it doesn't exist.
    • Timestamps get rewritten after the fact. Append-only, or the review is theater.
    • One person keeps the timeline and also fixes the problem. Split the roles or the log dies mid-fire.
    • Entries without evidence. "09:14 restarted" is a diary; "09:14 rolled back, error rate 14→2%" is a fact.

    The 20-minute version

    Paste five lines into your incident channel template today — DETECTED, DECLARED, MITIGATED, RESOLVED, NOTIFIED — with the format above. Run it on the next outage, however small. The first postmortem that starts with five timestamps instead of a scroll-back will sell your team on the whole idea by itself.

    If you'd rather start from a pre-written page, we keep the one-page version — the exact first-30-minutes card our crew runs, with the timeline format and the comms prompts filled in — as a free checklist: The First 30 Minutes (free). The paid kit adds the comms templates and the full runbook: Ops Starter Kit ($14).