s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

Incident response & detectionIR series

Status update by phase

Three status updates, three different jobs. The phase decides what the page must contain, and a template that asks for the same six fields every time makes the difference visible.

Quick reference

InvestigatingIdentifiedResolved
What happenedAn alert, scope unknownA named failureThe fix, verified
ImpactBeing measuredNumbers and scopeFinal count
ActionLooking, nothing changedContained, fixingRolled back, watched
ETANone promisedA time you will holdWhen we close
Next updateInside 15 minutesAt the promised timeBefore the close
OwnerIncident leadIncident leadService owner

How to pick

  • Investigating → name the symptom and the next update time.
  • Identified → put numbers on the impact and hold the ETA.
  • Resolved → say what changed and what is still watched.

Explained

What happened. Investigating names the symptom, not the cause: checkout errors, scope unknown. Identified names the failure: a bad release, one service, 4.1 per cent of card payments. Resolved names what changed, and what is still being watched.

Impact. Investigating measures it, identified quantifies it with a scope, and resolved closes the count. A page that keeps saying significant impact after the fix is a page nobody trusts.

Action. Investigating is a verb with no object yet. Identified is containment and a fix in progress. Resolved is the rollback or the patch, plus the monitoring that follows it.

ETA. Investigating promises no time for the fix, only a time for the next update. Identified holds a time you can defend. Resolved needs none, because the next communication is the close.

Next update. Fifteen minutes while investigating, the promised time once identified, and one final update before close.

Owner. The incident lead owns the first two columns; the service owner owns the third, because the follow-up outlives the incident.

The grid lays the three phases side by side, so a missing cell is a blank you can see before you publish.

The honest caveat: phases overlap in a real incident, and a page that lags the room is worse than one that admits it.

The lesson: the phase is a contract about what the update must contain.

In one line

The phase decides what the update says. Three columns, one template, six fields that must not be blank.

Draft the update

python3 status_update.py inc.json identified

More notes: Incident response & detection

Open in the notes app: search, filters, copy This note on GitHub