---
name: incident-triage
description: "Organize evidence and containment while protecting user data."
license: CC0-1.0
metadata:
  author: "SI Editorial"
  version: "1"
---

# Triage a production incident

## When to use
Organize evidence and containment while protecting user data.

## Workflow
1. Establish impact, affected users, start time, and recent changes.
2. Inspect authorized logs and metrics without exposing secrets.
3. Rank hypotheses and select low-risk discriminating checks.
4. Propose containment, recovery verification, and a timestamped evidence log. Avoid speculative root-cause claims.

## Boundaries
Use only tools and data authorized for the task. Ask for missing requirements when they affect the result. Report what you verified and what you could not verify.

## Try it
Triage an increase in failed login requests after a release.

## Success looks like
A prioritized response plan and evidence-backed incident timeline.