Beginner
Start here
What MTTD leaves out of an incident
Distinguish when a failure was detected from when response began.
Read the articleIncident response
Follow the work from the first signal to a verified recovery and the decisions that follow.
Intermediate
Clarify who can authorize the response
Who can authorize the next incident mitigation?
Connect coordination with the authority required for mitigation.
Read the guideIntermediate
Build the procedure
SRE runbook template with a database connection example
Adapt a runbook with explicit scope, stop conditions, and recovery checks.
Read the guideIntermediate
Evaluate the follow-through
Keep the unfinished risk visible after the fix ships
Decide what a corrective action actually demonstrated.
Read the guidePut it into practice
Calculator
Incident timeline calculator
Calculate response intervals with UTC-normalized timestamps and a range for uncertain onset.
- Input
- Incident timestamps and evidence
- Output
- Response intervals with unknowns and recovery evidence
Calculator
MTTD calculator
Compare mean, median and range while keeping missing and excluded incidents visible.
- Input
- Paste or upload incident data
- Output
- Mean, median and range with missing-data counts
Builder
Guided runbook builder
Create a service procedure with escalation, bounded mitigation and recovery checks.
- Input
- Service details and recovery checks
- Output
- An editable procedure with escalation and recovery checks
Tracker
Postmortem action tracker
Follow a corrective action from delivery to its verification test and remaining risk.
- Input
- Actions, owners and verification evidence
- Output
- An action register with owners, verification evidence and remaining risk
Related AI news
News ·
What Anthropic actually tested in its AI self-replication study
Anthropic ran a model across TV boxes and tested replication in a separate emulated fleet. Keeping those experiments apart reveals what the research actually shows.
News ·
Anthropic takes internal evaluations offline after unintended agent actions
A broken practice task can send an agent toward a real service. Anthropic’s October review explains the containment change and the realism it leaves to test.
News ·
Mistral Large 4 adds published weights for software investigations
An orders API starts returning server errors after an update. Follow that mystery with Mistral Large 4, now available as published weights as well as a hosted preview.
More on incident response
Explainer · 8 min read
PHP2Shell: the real risk behind the AI-hacking alarm
An attacker may make a vulnerable PHP web worker run their code and reach its credentials. Follow the runtime fixes, later notices and separate investigation needed before calling the service recovered.
Guide · 4 min read
Give responders the same picture of an incident
Put observations, times and working explanations in one usable record, then show how new evidence changes the next question.
Guide · 4 min read
Organize an investigation without conflicting changes
Give each workstream a question, an owner and a check-in time. Keep technical exploration separate from conflicting changes to the same system.
Guide · 4 min read
Communicate while the answer is still changing
Practice telling customers, responders and leadership the same changing truth, with useful detail and a next update they can rely on.