The most tedious part of any postmortem is reconstructing what happened when. Your telemetry already knows. The timeline can assemble itself while you focus on why.

Half of every postmortem meeting is spent arguing about the order of events from memory. Meanwhile, the exact order sits in your telemetry, timestamped to the millisecond, waiting to be asked.

The timeline is a query, not a memory

Deploys, alerts, scaling events, config changes, and error spikes are all timestamped events in systems you already run. An incident timeline is just those events, for the relevant window, sorted. There is no reason to reconstruct it by hand.

Assemble the streams

union deploys, alerts, scaling_events, config_changes
| where ts between "2026-07-11 02:00" and "2026-07-11 03:30"
| project ts, source, actor_role, summary
| sort ts asc

What automation gets right

  • Accuracy — machine timestamps do not misremember which came first.
  • Completeness — the quiet config change nobody thought to mention is right there.
  • Speed — the timeline is ready before the meeting, so the meeting is about meaning.

Leave the "why" to humans

Automation should build the timeline, not interpret it. Once the sequence is on the table — deploy at 02:14, error spike at 02:16, alert at 02:19 — the human work of understanding causation gets sharper, because everyone is arguing about the same facts. The machine handles "what happened when"; the room handles "and why."