Path 04 / Learning syllabus
Incident management
Lead a fictional incident as new evidence arrives, the first mitigation fails and another responder takes over. Learn how to keep the team coordinated and establish that users have recovered.
Explore the syllabus
Your course project
A tabletop incident record
Lead a Dispatch export incident that unfolds through new evidence, a failed mitigation and a shift handoff. Keep one working incident record throughout. Finish with verified recovery, a customer update and follow-up actions that address what made the response difficult.
Before you begin
Start where it makes sense.
For on-call engineers, incident leads and technical managers. No incident-command experience is required. Work through a fictional tabletop using a stated severity policy, timed evidence and role cards; no live-system changes are involved.
Already know the foundations? Jump to any lesson in the syllabus.
Start with the supplied examples. Each exercise explains what you need, what to try and how to check the result; software-based exercises use a disposable practice environment.
The ordered path
What you will learn
Follow the sequence to build the course project, or open the lesson that answers your question.
- 01BeginnerLesson · 6 min read
Recognize an incident and start the response
Identify credible user impact and begin coordination before the cause is known. Record the initial scope, unknowns and next update.
What you will try
Use the opening evidence packet to declare the incident, start its record and write the first factual update.
- 02BeginnerLesson · 5 min read
Set severity, roles and decision authority
Apply the training severity policy, name the incident lead and assign technical and communication responsibilities. Reassess as impact changes.
What you will try
Assign roles for a small response team, classify the impact and identify the condition that requires escalation.
- 03BeginnerLesson · 4 min read
Build a shared picture of the incident
Separate observed impact from hypotheses. Track affected users, event times, discovery times and actions in one record.
What you will try
Reconcile a dashboard, a customer report and a deployment log; mark conflicting timestamps without inventing an onset time.
- 04IntermediateLesson · 4 min read
Organize the investigation without losing control
Give each workstream a question, an owner and a check-in time. Keep technical exploration separate from conflicting changes to the same system.
What you will try
Dispatch two investigation tasks, reconcile their findings and stop a proposed change that conflicts with work already underway.
- 05BeginnerLesson · 5 min read
Communicate while the answer is still changing
Write for responders, customers and leadership using the same facts. State impact, progress, uncertainty and the next update without guessing a recovery time.
What you will try
Produce an internal update and a customer update, then correct both when new evidence changes the scope.
- 06BeginnerLesson · 5 min read
Choose a mitigation and check what it changed
Compare impact reduction, prerequisites, authority and reversibility. Agree how the team will judge the action before executing it.
What you will try
Compare rollback with a bounded traffic change, choose one and record its authorization, expected effect and verification.
- 07IntermediateLesson · 4 min read
Regroup when the first mitigation fails
Use the observed result to revise the response. Escalate expertise or authority, retain useful completed work and prevent repetition of a failed action.
What you will try
Respond to an injected mitigation failure: update the hypothesis, narrow the next action and explain the change to stakeholders.
- 08IntermediateLesson · 4 min read
Hand over a prolonged incident
Transfer leadership explicitly, including current impact, active work, decisions, risks and the next update. Make responder fatigue part of staffing decisions.
What you will try
Give a replacement lead a short handoff and confirm they can name the next decision and who owns each open task.
- 09BeginnerLesson · 4 min read
Verify recovery before closing the incident
Check the original user operation and distinguish restored new work from backlogs, delayed results and residual impact.
What you will try
Review new and previously queued exports, define the observation period and record which remaining work has a named owner.
- 10IntermediateLesson · 4 min read
Explain the incident without hindsight
Reconstruct the response using what people knew at the time. Explain contributing conditions and decision constraints rather than assigning a convenient single cause.
What you will try
Write a concise review connecting the timeline, customer impact, failed mitigation and remaining causal questions.
- 11IntermediateLesson · 4 min read
Rehearse the improvement and show the difference
Choose a follow-up that addresses a response problem and define what another exercise should demonstrate. Keep delivery status separate from verified improvement.
What you will try
Replay the failed-mitigation segment after one improvement; compare decisions and evidence with the original response.
