conducting-post-incident-lessons-learned - Post-Incident Lessons Learned Review
Facilitate structured post-incident reviews to identify root causes and produce actionable recommendations
Tags
Updated: 2026-03-23Capabilities
Typical Inputs
Typical Outputs
What this skill does
- gather incident data
- conduct post-mortem meeting
- perform root cause analysis
- calculate response metrics
- document findings
- create action items
- update playbooks
- update detection rules
Inputs
- incident timeline
- SIEM metrics
- responder logs
- incident responders
- meeting space
- incident ticketing system
Outputs
- meeting minutes
- root cause analysis document
- incident metrics report
- action items list
- updated playbooks
- updated detection rules
Requirements
- incident fully resolved
- incident documentation gathered
- incident responders available
- TheHive or ServiceNow
- Jira or Azure DevOps
- Confluence or SharePoint
- Splunk or Elastic
- Sigma