Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions config/_default/menus/main.en.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2552,6 +2552,11 @@ menu:
parent: post_incident
identifier: post_incident_follow_ups
weight: 301
- name: Postmortems
url: incident_response/incident_management/post_incident/postmortems
parent: post_incident
identifier: post_incident_postmortems
weight: 302
- name: Analytics and Reporting
url: incident_response/incident_management/analytics_and_reporting
parent: incidents
Expand Down
3 changes: 2 additions & 1 deletion content/en/getting_started/incident_management/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -160,7 +160,7 @@ In the _Notifications_ section, you can send out a notification updating the sta
8. For the timeline section, select **Marked as Important** so that only the _Important_ events are added to the postmortem.
9. Click **Generate**.

The postmortem is generated as a Datadog Notebook or Confluence page, and it includes the timeline events and resources referenced during the investigation and remediation. This makes it easier to review and further document what caused the issue and how to prevent it in the future.
The postmortem includes the timeline events and resources referenced during the investigation and remediation. This makes it easier to review and further document what caused the issue and how to prevent it in the future. For more information, see [Incident Postmortems][17].

If there are follow-up tasks that you and your team need to complete to ensure the issue doesn't happen again, add those and track them in the Post-Incident's _Incident Tasks_ section.

Expand Down Expand Up @@ -201,3 +201,4 @@ You can also declare and edit incidents and quickly communicate to your teams th
[14]: https://play.google.com/store/apps/details?id=com.datadog.app
[15]: https://app.datadoghq.com/dashboard/lists
[16]: https://app.datadoghq.com/monitors/manage
[17]: /incident_response/incident_management/post_incident/postmortems
7 changes: 4 additions & 3 deletions content/en/incident_response/incident_management/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -107,15 +107,15 @@ Incident Management integrates closely with other Datadog products, including:

- [Datadog Status Pages][26] to create public or private status pages and connect them to incidents.
- [Datadog On-Call][27] to escalate pages into incidents and manually or automatically page teams from an incident.
- [Datadog Notebooks][28] to draft and review postmortems.
- [Datadog Notebooks][28] to draft and review [postmortems][34].
- [Datadog Workflow Automation][29] to build and execute automations.

### Third-party integrations

Incident Management integrates with third-party applications, including:

- [Atlassian Statuspage][25] to create and update Statuspage incidents.
- [Confluence][22] to generate incident postmortems.
- [Confluence][22] to generate incident [postmortems][34].
- [CoScreen][14] to launch collaborative meetings with multi-user screen sharing, remote control, and built-in audio and video chat.
- [CoTerm][21] to follow terminal-based incident remediation activities in real time.
- [Jira][15] to create a Jira ticket for an incident.
Expand Down Expand Up @@ -162,4 +162,5 @@ Incident Management integrates with third-party applications, including:
[30]: /incident_response/incident_management/investigate/declare#from-a-monitor
[31]: https://www.datadoghq.com/pricing/?product=incident-response#products
[32]: /account_management/billing/incident_response/
[33]: /getting_started/search/#event-based-queries
[33]: /getting_started/search/#event-based-queries
[34]: /incident_response/incident_management/post_incident/postmortems
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,8 @@ To generate an AI-assisted postmortem draft:
1. Click **Generate**. Allow up to one minute for the postmortem to be generated. Do not close the tab during this time.
1. Review the AI-generated postmortem draft. It serves as a starting point for your incident responders. Datadog recommends reviewing and refining the draft before sharing it.

For more information on generating and managing postmortems, see [Incident Postmortems][6].

## Further reading

{{< partial name="whats-next/whats-next.html" >}}
Expand All @@ -149,3 +151,4 @@ To generate an AI-assisted postmortem draft:
[3]: https://app.datadoghq.com/incidents/settings?section=postmortem-templates
[4]: https://app.datadoghq.com/incidents/settings?section=integrations
[5]: /incident_response/incident_management/post_incident/follow-ups
[6]: /incident_response/incident_management/post_incident/postmortems
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@
title: Post Incident
description: Manage postmortems and follow-up tasks after incident resolution
further_reading:
- link: "/incident_response/incident_management/post_incident/postmortems"
tag: "Documentation"
text: "Generate and manage postmortems"
- link: "/incident_response/incident_management/setup_and_configuration/templates"
tag: "Documentation"
text: "Configure postmortem and message templates"
Expand All @@ -26,7 +29,7 @@ Use post-incident activities to:

## Postmortems

Postmortems are essential for continuous improvement of your incident response process. After an incident is resolved, you can generate a postmortem that automatically populates with incident information using a Datadog Notebook or Confluence page.
Postmortems are essential for continuous improvement of your incident response process. After an incident is resolved, you can generate a postmortem that automatically populates with incident information using a Datadog Notebook, Confluence page, or Google Drive document.

An incident postmortem typically includes:

Expand All @@ -37,16 +40,7 @@ An incident postmortem typically includes:
- **Action items**: Specific tasks to prevent recurrence
- **Lessons learned**: Key takeaways for the organization

After generating a postmortem, you can:

1. Assign an owner to complete the postmortem documentation
2. Track postmortem state (draft, in review, or published)
3. Collaborate with team members using Notebook features
4. Link related documents and resources

To configure postmortem templates and customize the structure of your postmortems, navigate to [Incident Settings][1] and define templates that match your organization's needs.

For more information, see [Postmortem Templates][2].
For more information on generating postmortems and configuring templates, see [Incident Postmortems][2].

## Follow-ups

Expand All @@ -69,7 +63,7 @@ For more information on integrating status pages with your incident workflow, se
{{< partial name="whats-next/whats-next.html" >}}

[1]: https://app.datadoghq.com/incidents/settings
[2]: /incident_response/incident_management/setup_and_configuration/templates#postmortems
[2]: /incident_response/incident_management/post_incident/postmortems
[3]: /integrations/jira/
[4]: /incident_response/case_management/
[5]: /incident_response/incident_management/post_incident/follow-ups
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,105 @@
---
title: Incident Postmortems
description: Generate and manage postmortems to document incidents and drive continuous improvement.
further_reading:
- link: "/incident_response/incident_management/setup_and_configuration/templates"
tag: "Documentation"
text: "Configure postmortem templates"
- link: "/incident_response/incident_management/setup_and_configuration/variables"
tag: "Documentation"
text: "Incident variables reference"
- link: "/incident_response/incident_management/post_incident/follow-ups"
tag: "Documentation"
text: "Manage incident follow-up tasks"
- link: "/notebooks/"
tag: "Documentation"
text: "Datadog Notebooks"
---

## Overview

A postmortem is a structured document that captures what happened during an incident, why it happened, and what actions to take to prevent recurrence. Generating a postmortem after an incident helps your team:

- Document root cause and impact for future reference
- Drive accountability for remediation work
- Build organizational knowledge to reduce the frequency and severity of future incidents

Datadog automatically populates postmortems with incident data using templates you define. You can generate postmortems directly to [Datadog Notebooks][1], [Confluence][2], or [Google Drive][3].

## Permissions

- To generate a postmortem, you need the **Incidents Write** permission.
- To view a generated postmortem in Datadog Notebooks, you need the **Notebooks Read** permission.

<div class="alert alert-danger">For private incidents, postmortems generated in Datadog Notebooks are accessible to any user with Notebooks read permission, regardless of whether they have access to the private incident. Take this into consideration when generating postmortems for incidents that contain sensitive data.</div>

## Generate a postmortem

{{< img src="/incident_response/incident_management/post_incident/postmortems/generate_postmortem.png" alt="The Post-Incident tab with options to generate a new postmortem or attach an existing one" style="width:100%;" >}}

After an incident is resolved, a **Generate post-mortem** button appears on the incident. You can also generate a postmortem at any time from the incident's **Post-Incident** tab.

To generate a postmortem:

1. Open the incident and go to the **Post-Incident** tab.
1. Click **Generate new post-mortem**.
1. Select a postmortem template. A preview of the template appears on the right.
1. Click **Generate**. Datadog creates the postmortem in the destination configured in the template and links it to the incident.

After generating a postmortem, click the link in the **Post-Incident** tab to open it in the configured destination.

## Configure postmortem templates

{{< img src="/incident_response/incident_management/post_incident/postmortems/configure_postmortem_templates.png" alt="A Postmortem editor with the Datadog Notebook selected as the Save Location" style="width:100%;" >}}

Postmortem templates define the structure of generated postmortems and control where they are saved. To create or edit templates, go to [**Incident Management Settings > Post-Mortem Templates**][4].

### Save location

Use the **Save Location** dropdown in the template editor to select where the generated document is saved:

| Option | Requirements |
|---|---|
| **Datadog Notebooks** | No additional setup required. |
| **Confluence** | Requires the [Confluence integration][2]. Configure your Confluence account in the integration settings before selecting it as a destination. |
| **Google Drive** | Requires the [Google Drive integration][3]. Configure your Google account in the integration settings before selecting it as a destination. |

### Template variables

Templates support variables that populate with incident data when the postmortem is generated. Variables allow you to include relevant incident context automatically without copying it manually. For a full list of available variables, see the [Incident Variables][6] reference.

**Standard variables** pull directly from incident fields:

| Variable | Description |
|---|---|
| `{{incident.title}}` | The incident title |
| `{{incident.state}}` | The current incident state (for example: `active`, `stable`, `resolved`) |
| `{{incident.severity}}` | The incident severity level |
| `{{incident.commander}}` | The incident commander's name, or their email or handle if no name is set |

Any [custom property fields][5] you have defined are also available as variables.

**The incident card variable** (`{{incident.card}}`) embeds a summary card that reflects incident fields in real time. When incident fields change, the card in the postmortem updates automatically, reducing the need to switch between the two. **Note**: The incident card is only supported in Datadog Notebooks.

**AI variables** use Bits AI to generate suggested content based on incident data. When you generate a postmortem that includes an AI variable, Datadog provides a suggested value that you can accept, edit, or reject before it is saved. The `{{incident.ai_summary}}` variable, for example, generates a suggested summary of what occurred during the incident.

## Attach an existing postmortem

If a postmortem for an incident already exists outside of Datadog, or was created before the incident was opened, you can link it directly from the **Post-Incident** tab without generating a new one. The linked postmortem can be any URL—a Datadog Notebook, a Confluence page, a Google Doc, or any external document.

To attach an existing postmortem, open the **Post-Incident** tab and use the **Attach existing post-mortem** option to add the link.

## Remove a postmortem

To remove a postmortem from an incident, open the **Post-Incident** tab, find the postmortem entry, and select the option to remove it. Removing the link does not delete the underlying document.

## Further reading

{{< partial name="whats-next/whats-next.html" >}}

[1]: /notebooks/
[2]: /integrations/confluence/
[3]: /integrations/google_drive/
[4]: https://app.datadoghq.com/incidents/settings?section=postmortem-templates
[5]: /incident_response/incident_management/setup_and_configuration/property_fields
[6]: /incident_response/incident_management/setup_and_configuration/variables
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ further_reading:

## Overview

Dynamic templates offer a comprehensive framework for improving incident response and operational efficiency. Using custom message templates for both ad-hoc and automated notifications can save time during high-stress incidents. This ensures that messages are consistently accurate and contain relevant context, enabling quicker understanding and action by the recipients.
Dynamic templates offer a comprehensive framework for improving incident response and operational efficiency. Using custom message templates for both ad-hoc and automated notifications can save time during high-stress incidents. This ensures that messages are consistently accurate and contain relevant context, enabling quicker understanding and action by the recipients.

Customizable settings for postmortem analysis can provide valuable information and long-term optimization. By tailoring reports and dashboards to your organization's unique context, you can identify recurring issues and implement preventative measures more effectively.

Expand All @@ -24,27 +24,29 @@ Message templates are dynamic, reusable messages that can be used in [manual inc

To create a message template:

1. Click the **+ New Message Template** button
2. Give the template a name
3. Assign it a new or existing category
4. Give the template a subject line (for emails)
5. Write the template's message
6. Click **Save**
1. Click the **+ New Message Template** button.
2. Give the template a name.
3. Assign it a new or existing category.
4. Give the template a subject line (for emails).
5. Write the template's message.
6. Click **Save**.

**Note:** Template variables are supported in both the message's title and body.

## Postmortems

Postmortem templates are dynamic, reusable templates used to create a [Datadog Notebook][2] or [Confluence page][3] that is automatically populated with incident information after an incident has been resolved. Postmortem templates use [template variables][4], such as `{{incident.severity}}`, to dynamically inject the corresponding value from the incident that the postmortem is being created for.
Postmortem templates are dynamic, reusable templates used to create a postmortem that is automatically populated with incident information after an incident has been resolved. Postmortem templates use [template variables][4], such as `{{incident.severity}}`, to dynamically inject the corresponding value from the incident that the postmortem is being created for.

To create a postmortem template:

1. Click the **+ New Postmortem Template** button
2. Give the template a name
3. Select either a Datadog Notebook or a Confluence page to be created at generation
4. Write the template's content (available template variables are listed to the right of the textbox)
5. (Optional) Set the template as the default
6. Click **Save**
1. Click the **+ New Postmortem Template** button.
2. Give the template a name.
3. Select the location you want the template to generate (Datadog Notebook, Google Drive, Confluence).
4. Write the template's content (available template variables are listed to the right of the textbox).
5. (Optional) Set the template as the default.
6. Click **Save**.

For more information on generating postmortems using these templates, see [Incident Postmortems][5].

## Further reading

Expand All @@ -53,4 +55,5 @@ To create a postmortem template:
[1]: /incident_response/incident_management/notifications
[2]: /notebooks/
[3]: /integrations/confluence/
[4]: /incident_response/incident_management/setup_and_configuration/variables
[4]: /incident_response/incident_management/setup_and_configuration/variables
[5]: /incident_response/incident_management/post_incident/postmortems
5 changes: 3 additions & 2 deletions content/en/notebooks/_index.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ further_reading:

## Overview

Notebooks are collaborative rich text documents that give you all the power of Datadog graphs. Multiple users can work together to put together an investigation or postmortem featuring live data from your incident. Notebooks are also great for runbooks and documentation featuring real insights into your systems alongside your content.
Notebooks are collaborative rich text documents that give you all the power of Datadog graphs. Multiple users can work together to put together an investigation or [postmortem][8] featuring live data from your incident. Notebooks are also great for runbooks and documentation featuring real insights into your systems alongside your content.

## Creating a notebook

Expand All @@ -39,7 +39,7 @@ You can create a notebook in two places:

### Notebook templates

In the [Template Gallery][2], see ready-to-use templates which you can create new notebooks from. Templates include an Incident Response postmortem, an Incident Report, and SLO Specification. You can also create a new custom template to build reusable notebook structures.
In the [Template Gallery][2], see ready-to-use templates which you can create new notebooks from. Templates include an Incident Response [postmortem][8], an Incident Report, and SLO Specification. You can also create a new custom template to build reusable notebook structures.

## Editing a notebook

Expand Down Expand Up @@ -297,3 +297,4 @@ You can sort notebooks by selecting the ⭐, details, or modified headers to sor
[5]: /dashboards/template_variables/
[6]: /notebooks/guide/version_history
[7]: /account_management/rbac/
[8]: /incident_response/incident_management/post_incident/postmortems
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading