How Do You Track Production Incidents for Reviews and Postmortems?

We rely on ServiceNow to handle our incidents. All our incident management, problem tracking, and changes flow through it. Depending on your organization's size, you might need someone dedicated to own the workflow to make sure everything is handled properly.

I find a mix of methods works best for us. We use tickets for incident tracking, while a shared document is used for postmortem write-ups that include timelines, root causes, and action items. It’s crucial to tag everything consistently so we can search for patterns later.

In our setup, we have a Teams Channel with representation from every IT department. When a major incident occurs, our Service Manager creates an incident right away. This role is crucial because it ensures that there’s accountability and minimizes confusion.

We usually go with tickets for tracking incidents. It's straight to the point and helps us keep everything organized.

The approach we take can depend on the type of incident. For cybersecurity issues, the process is much more involved—just using a simple tracker isn't usually enough when you've got a SOC team working alongside other departments. These matters need urgent attention and more detailed documentation.