Path 04 / Learning syllabus
Incident management
Organize a response that restores service while keeping decisions, responsibilities and customer communication clear.
Explore the syllabus- 01Recognize an incident and start the responseAvailable guide
- 02Establish roles and a shared recordComing soon
- 03Assess severity and escalateComing soon
Your course project
A tabletop incident record
Respond to a staged Dispatch export disruption. Produce an initial record, role assignments, evidence timeline, mitigation decision, customer updates, handoff, recovery criteria and a post-incident review.
Before you begin
Start with the foundations.
For engineers, on-call responders and technical leaders learning to coordinate service incidents. No incident-command experience is required; exercises are tabletop scenarios.
Each exercise states what you need and how to check its result. Use practice data and a disposable lab.
The ordered path
What you will learn
Follow the order, or open the guide that answers your question. Lessons marked Coming soon are not available yet.
- 01Available guide · 6 min read
Recognize an incident and start the response
Identify credible user impact and create a shared response before the cause is fully understood.
What you will try
Write the initial incident record and update from a small packet of observed facts.
- 02Coming soon
Establish roles and a shared record
Separate coordination, technical execution and communications without requiring a large team.
What you will try
Assign accepted responsibilities and identify who can authorize a consequential change.
- 03Coming soon
Assess severity and escalate
Apply the organization’s impact criteria and revisit the classification as evidence changes.
What you will try
Classify three versions of the export incident using an explicit training policy and record what would change severity.
- 04Coming soon
Build an evidence-based timeline
Separate event time, discovery time and recording time; preserve uncertainty.
What you will try
Reconcile contradictory timestamps without assigning a false impact-onset time.
- 05Coming soon
Coordinate investigation in parallel
Give each investigation thread a question, responsible responder and check-in point.
What you will try
Organize two competing hypotheses without allowing simultaneous conflicting production changes.
- 06Coming soon
Choose and authorize a mitigation
Compare expected benefit, scope, prerequisites and reversibility under time pressure.
What you will try
Evaluate a rollback and a bounded traffic change, including the required authority and verification.
- 07Coming soon
Write useful incident updates
Communicate confirmed impact, work underway and the next update without promising an unsupported recovery time.
What you will try
Write an internal update and a customer-facing update from the same evidence.
- 08Coming soon
Handle handoffs and prolonged incidents
Transfer coordination explicitly and retain unresolved risks and work.
What you will try
Brief a replacement lead and confirm acceptance using the live record.
- 09Coming soon
Verify recovery and manage remaining work
Check the original user operation as well as backlogs, retries and residual impact.
What you will try
Separate restored new exports from delayed earlier exports and assign the remaining recovery work.
- 10Coming soon
Run a useful post-incident review
Explain contributing conditions and decisions with the evidence available at the time.
What you will try
Write a concise review that distinguishes established facts from unanswered causal questions.
- 11Coming soon
Follow through and rehearse again
Check whether corrective actions change the failure scenario and improve response readiness.
What you will try
Re-run the tabletop with one improvement, document the changed behavior and identify remaining exposure.
