The worst time to write a postmortem is immediately after an incident.
You've just spent four hours in a bridge call. You're tired. You have follow-up tickets to create, stakeholders to update, and your regular work has stacked up in the background. And now you have 24 hours to produce a structured postmortem document that:
- Has a complete timeline
- Identifies a root cause with a 5-why analysis
- Assigns action items with owners and priorities
- Includes a prevention plan
- Is polished enough to share with the CISO and VP of Engineering
That's two hours of work on a good day. On the day of a P1 incident, it's brutal.
The Insight
The information is all there. You know what happened. You were on the call. You have the Slack thread, the monitoring alerts, the runbook you ran. The bottleneck isn't information — it's time and formatting.
That's exactly what Claude is good at. Give it the raw facts in plain language; it produces the structured document. You review and correct; it doesn't replace judgment, it removes the blank-page problem.
What the Tool Does
The Incident Postmortem AI is a Streamlit app. You fill in:
- Incident title and severity (P1–P4)
- Duration (when it started, when it was resolved)
- Affected systems (checkboxes: Okta, MDM, Google Workspace, Slack, GitHub, Salesforce, custom)
- What happened — a free-text description in plain English. Bullet points, fragmented sentences, whatever you have
Hit generate. Claude produces:
Timeline — a structured sequence of events reconstructed from your description, formatted in HH:MM — Event format.
5-Why Root Cause Analysis — starting from the surface symptom and drilling down to the systemic failure. This is the part that takes the longest to write by hand and where the tool adds the most value. Humans are naturally drawn to stopping at the first proximate cause ("the server went down"). A 5-why analysis pushes further ("why was there no redundancy? why wasn't the monitoring threshold set correctly? why wasn't that caught in the last review?").
Action Items — each with an owner role (not a specific person — roles, so the postmortem isn't immediately stale when someone changes jobs), priority, and due date category.
Prevention Measures — systemic changes to prevent recurrence, separate from the immediate action items.
Severity Assessment — customer impact, blast radius, MTTR, and an SLA analysis.
The full output is generated as structured JSON and parsed into expandable sections. One-click Markdown export for your wiki or postmortem tracking system.
Does It Actually Hold Up?
I ran a backtest against six real postmortems I'd written by hand over the previous year. Fed the raw incident descriptions into the tool and compared the output to what I'd produced.
Timeline: Accurate in all six cases. Claude reconstructed the event sequence correctly from my plain-language descriptions, though it occasionally needed a second pass to infer timestamps I'd left implicit ("about 20 minutes later" → specific time).
5-Why Analysis: This was the most interesting comparison. In four of six cases, the AI analysis went one level deeper than my manual analysis. In two cases, it identified a contributing factor I'd deliberately omitted from the postmortem (because the full root cause was politically sensitive) — which was a useful reminder that postmortem quality is partly a cultural problem, not just a tooling problem.
Action Items: Accurate but sometimes too granular. Claude tends to generate 8–10 action items where I'd have written 4–5, because it doesn't know which ones are actually going to get tracked vs. which ones will get deprioritized immediately. I typically trim the list during review.
The 30 Seconds Number
Honest accounting: the tool generates the postmortem in 30–45 seconds. I spend another 10–15 minutes reviewing, correcting specifics, and trimming the action item list. Total time for a complete, polished postmortem: under 20 minutes.
Without the tool: 90–120 minutes.
For a team running 2–3 significant incidents per month, that's 3–5 hours of postmortem writing time recovered per month. More importantly, it means postmortems actually get written. The ones that didn't get written because everyone was too tired after the incident — that's the real cost.
The tool is open source on GitHub. Setup requires an Anthropic API key. The severity classification and affected systems list are configurable — you can adapt it to your specific environment in about an hour.