Playbook

Incident Triage Playbook

Classify severity quickly and run the first checks with confidence.

Sev 1: full outage, data loss, or safety/security breach.

Sev 2: major feature down, significant latency or error rate.

Sev 3: partial degradation, limited user impact.

Sev 4: minor issue or cosmetic impact.

Confirm scope: regions, tenants, endpoints, and user tiers.

Check recent deploys, config changes, and feature flags.

Verify dependencies: DB, cache, queues, and third-party APIs.

Look at p95/p99 latency and error rate deltas.

Mitigate: rollback, scale, or disable risky features.

Communicate: update status page and incident channel.

Assign roles: incident commander, comms, and scribe.