Process

Incident response runbook

Incident response runbook Four actors — on-call, incident lead, comms, reliability — across six ordered steps read left to right. On-call detects the alert, the incident lead triages it, on-call mitigates, the incident lead verifies the fix as the focal step, comms notifies, and reliability reviews. A dashed orchestration trigger runs back from mitigate to triage when containment fails. Step 1 detect 2 triage 3 mitigate 4 verify 5 notify 6 review On-call Incident lead Comms Reliability OC Detect alert → incident alerting LS IL Triage incident → severity on-call console LS DB OC Mitigate severity → fix deploy pipeline DB DB IL Verify fix → verified monitoring DB DB CM Notify verified → notice status page DB FL RE Review incident → actions issue tracker FL Payload codes — LS alert stream · DB incident record · FL published report. Left chip is the input, right chip the output. Connectors — muted solid is a routine handoff; accent solid enters and leaves the focal step; muted dashed is the re-test trigger back to triage.