Runbook generator from past incidents
Turn your incident history into structured, repeatable runbooks that your team can execute under pressure.
Ingredients
- Postmortem documents from the last 6 months
- Incident timeline exports (PagerDuty, Opsgenie, or CSV)
- Monitoring alerts correlated to each incident
- Access to runbook template (Confluence, Notion, or Markdown)
Method
- 1Cluster incidents by root cause category. Group similar failures together so each runbook covers a distinct failure mode.
- 2Extract the diagnostic path. For each cluster, list the exact queries, dashboards, and log filters responders used to confirm the issue.
- 3Document the mitigation steps in order. Include exact commands, feature flags, and rollback procedures.
- 4Add escalation triggers. Define clear thresholds for when to page secondary on-call or escalate to engineering leads.
- 5Validate with a tabletop exercise. Walk the runbook against a simulated incident and refine gaps.
Output
A set of Markdown runbooks organized by failure mode, each containing diagnostic queries, step-by-step mitigations, escalation paths, and links to relevant dashboards.
Pro tip: Store runbooks alongside your alert definitions so they surface automatically when an alert fires. Meridian can link alerts directly to runbook steps.