Building the Incident Timeline
3 exercises — write blameless, chronological incident timelines using precise past-tense narrative.
0 / 3 completed
Timeline writing rules
- Always UTC — all timestamps in UTC to avoid timezone confusion.
- Chronological — earliest event first, latest last.
- Blameless — describe the system/process, never name individuals as the cause.
- Past tense — "The alert fired", "The rollback was completed", "Error rates returned."
- Specific — include exact times, percentages, and service names.
1 / 3
You are writing the incident timeline for a post-mortem. Which entry is written in the correct blameless style?
Option B is written in the blameless style: it describes what happened without naming who did it or using judgement words like "accidentally" or "incorrectly".
The blameless approach: focus on the system, process, or environment — not the individual. This is not about protecting anyone from accountability; it's about identifying systemic failures that allowed the mistake to happen. If "John ran it against prod", the real question is: why was production connectable from a dev machine? Why wasn't staging validation required? These are systemic failures.
Option A is blaming by name. Option C uses "accidentally" which implies human error. Option D uses "incorrectly" which implies poor performance. All three shift focus away from the systemic analysis.
The blameless approach: focus on the system, process, or environment — not the individual. This is not about protecting anyone from accountability; it's about identifying systemic failures that allowed the mistake to happen. If "John ran it against prod", the real question is: why was production connectable from a dev machine? Why wasn't staging validation required? These are systemic failures.
Option A is blaming by name. Option C uses "accidentally" which implies human error. Option D uses "incorrectly" which implies poor performance. All three shift focus away from the systemic analysis.