Most incident confusion happens before anyone has diagnosed anything — it happens because roles weren't assigned. Here is our first-15-minutes checklist.

The difference between a 20-minute incident and a 2-hour one is rarely technical skill. It's usually whether someone claimed the incident commander role in the first five minutes.

Declare before you diagnose

We used to wait until an issue was "confirmed serious" before declaring an incident, which meant the first 10 minutes were spent debating severity instead of responding. Now anyone can declare, and declaring costs nothing — a declared incident with no real impact gets closed in two minutes. The bar for declaring dropped; the bar for staying open didn't.

Three roles, assigned out loud

Incident commander, communicator, and one or more responders. The IC does not debug — their job is coordination and decisions, and we've found that ICs who start typing commands into a terminal stop doing the job that actually shortens the incident. The communicator posts status updates on a fixed cadence so responders never have to stop and answer "any update?" in the channel.

from incidents
| where declared_at > ago(30d)
| extend ic_assigned_delay = ic_assigned_at - declared_at
| summarize p50(ic_assigned_delay), p95(ic_assigned_delay)
| where p95_ic_assigned_delay > 5m

Timebox the first update

Whatever is known or unknown at the 15-minute mark gets posted, even if the honest answer is "we don't know yet, here's what we've ruled out." Silence in the first 15 minutes is what causes stakeholders to start their own side-channel investigation, which then competes with the actual response for the same engineers' attention.

Measure the handoff between declaring and assigning

We started measuring the gap between an incident being declared and an IC actually being assigned, and found a p95 of over five minutes — not because nobody wanted to lead, but because nobody explicitly claimed the role, so everyone quietly assumed someone else would. Adding a single bot prompt that asks "who is IC?" the moment an incident channel opens cut that gap by more than half.

  • Lower the bar to declare; keep the bar to stay declared.
  • Assign IC, communicator, and responder roles out loud, immediately.
  • The IC coordinates and decides — they don't debug.
  • Post a status update by the 15-minute mark even if it's "still investigating."
  • Track time-to-IC-assignment as its own metric — silence there costs real minutes.