Overview

A postmortem is a structured document that captures what happened during an incident, why it happened, and what actions to take to prevent recurrence. Generating a postmortem after an incident helps your team:

• Document root cause and impact for future reference
• Drive accountability for remediation work
• Build organizational knowledge to reduce the frequency and severity of future incidents

Datadog automatically populates postmortems with incident data using templates you define. You can generate postmortems to Datadog Notebooks, Confluence, or Google Drive. Postmortems generated as Datadog Notebooks embed directly in the Post-Incident tab, where you can view, edit, and track their status and ownership without leaving the incident.

Permissions

• To generate a postmortem, you need the Incidents Write permission.
• To view a generated postmortem in Datadog Notebooks, you need the Notebooks Read permission.

Generate a postmortem

After an incident is resolved, you can generate a postmortem from the incident’s Post-Incident tab.

To generate a postmortem:

1. Open the incident and go to the Post-Incident tab.
2. Select a postmortem template.
3. Click Generate Postmortem. Datadog creates the postmortem in the destination configured in the template and links it to the incident.

Generate a postmortem with Workflow Automation

You can also generate a postmortem from a workflow using the Generate postmortem action. The action takes an incident and a postmortem template, and attaches the resulting postmortem to that incident. Use this path to create postmortems as part of an automated post-incident process, such as after an incident is resolved.

For the full list of variables available to postmortem templates, see Templates and Incident variables.

View and edit a postmortem

View and edit your postmortem based on its destination:

• Datadog Notebooks: Embedded in the Post-Incident tab. Read and edit without leaving Datadog. Multiple users can edit simultaneously with cursor markers. Add inline comments. Changes are reflected in the underlying notebook.
• Confluence: Edit in Confluence (click the link in the Post-Incident tab to open your Confluence workspace).
• Google Drive: Edit in Google Docs (click the link in the Post-Incident tab to open Google Docs).

Convert timestamps to date chips

Postmortems often record times as plain text, such as Jul 23, 4:30 pm UTC. You can convert this text into date chips, which display the time in each reader’s own time zone.

Times in a postmortem are often recorded in different time zones by different responders. Conversion makes them uniform. As long as each time states its time zone, you do not need to standardize times by hand while drafting.

This option is available on notebooks with the Postmortem notebook type.

To convert timestamps in a postmortem:

1. Open the postmortem notebook.
2. Click the kebab menu in the upper right and select Convert timestamps.
3. Review the detected timestamps. Each entry shows the original text and the resolved time. If a timestamp has no explicit offset, Datadog interprets it in the time zone of the person performing the conversion. If it has no year, Datadog infers one.
4. Clear the checkbox for any timestamp you want to leave as plain text.
5. Click Convert.

Note: Datadog doesn’t convert datetime text that’s part of a link, such as a link to an event in the incident timeline. A date chip cannot also be a link.

Postmortem status and owner

Postmortems have two fields to help track completion and drive accountability:

The postmortem status values are:

The postmortem owner can be reassigned to any user in your Datadog organization. The owner is a system role that appears in the incident’s response team alongside Incident Commander and Responder.

Configure postmortem templates

To create or manage postmortem templates, including save location and template variables, see Templates.

Attach an existing postmortem

If a postmortem for an incident already exists outside of Datadog, or was created before the incident was opened, you can link it directly from the Post-Incident tab without generating a new one. The linked postmortem can be any URL—a Datadog Notebook, a Confluence page, a Google Doc, or any external document.

To attach an existing postmortem, open the Post-Incident tab and use the Attach existing post-mortem option to add the link.

Remove a postmortem

To remove a postmortem from an incident, open the Post-Incident tab, find the postmortem entry, and select the option to remove it. Removing the link does not delete the underlying document.

Further reading

Additional helpful documentation, links, and articles:

Configure postmortem templatesDOCUMENTATION Incident variables referenceDOCUMENTATION Manage incident follow-up tasksDOCUMENTATION Datadog NotebooksDOCUMENTATION