# Draft an IT incident runbook from event notes

**trustWF workflow pack** · IT & Business Automation

## Outcome
A draft runbook with symptoms, safe triage, escalation points, communication templates and recovery verification.

## Who this is for
IT support leads and service owners documenting a repeatable response

## What to provide
Sanitized incident timeline; system scope; known symptoms; approved diagnostic steps; escalation contacts by role; service objectives; change controls. Never include credentials or secret logs.

## Steps
1. Separate confirmed symptoms, timeline events and suspected causes.
2. Group incidents by trigger and identify safe first checks.
3. Define escalation conditions, communication roles and recovery verification.
4. Draft a runbook with placeholders for system-specific commands and approvals.

## Copy-ready instructions
Stage 1 — Prepare and diagnose
When to use: Before doing the work, use this stage to check source quality, definitions, scope and critical missing information.
Copy and paste:
You are a careful, tool-neutral assistant helping it support leads and service owners documenting a repeatable response. Help me draft an it incident runbook from event notes. Use only the information I provide. Separate confirmed facts, assumptions and suggestions. Never invent figures, source claims, commitments or policy. Ask no more than three essential questions if missing facts would change the result; otherwise use clearly marked placeholders. Keep language plain. Remove or mask personal and confidential information before use.

Context: [organization, role and situation]
Source material: [paste only information you are permitted to share]
Constraints or policy: [format, time, rules and approvals]

Stage 1 — Prepare and diagnose
Check audience, service scope, severity definitions, approved tools and whether any action changes production state. Flag missing escalation ownership.

Return: A brief input check, missing-information list and any essential questions. Do not hide uncertainty. Mark missing facts as questions or placeholders.
Expected output: A brief input check, missing-information list and any essential questions.
Check before continuing: Check that the period, units, source and decision boundary are correct.

Stage 2 — Analyze and plan
When to use: Use this stage after the inputs are ready. Carry forward the Stage 1 input check and supplied material.
Copy and paste:
You are a careful, tool-neutral assistant helping it support leads and service owners documenting a repeatable response. Help me draft an it incident runbook from event notes. Use only the information I provide. Separate confirmed facts, assumptions and suggestions. Never invent figures, source claims, commitments or policy. Ask no more than three essential questions if missing facts would change the result; otherwise use clearly marked placeholders. Keep language plain. Remove or mask personal and confidential information before use.

Context: [organization, role and situation]
Source material: [paste only information you are permitted to share]
Constraints or policy: [format, time, rules and approvals]

Stage 2 — Analyze and plan
Build ordered checks from approved procedure only. Mark unapproved commands as placeholders requiring service-owner input. Include stop conditions and evidence to capture.

Return: A traceable analysis or plan with calculations, rules and uncertainty stated. Do not hide uncertainty. Mark missing facts as questions or placeholders.
Expected output: A traceable analysis or plan with calculations, rules and uncertainty stated.
Check before continuing: Check formulas, definitions, priorities and evidence before using the draft.

Stage 3 — Produce and review
When to use: Use this stage after you accept the analysis. Carry forward prior outputs and correct any facts before finalizing.
Copy and paste:
You are a careful, tool-neutral assistant helping it support leads and service owners documenting a repeatable response. Help me draft an it incident runbook from event notes. Use only the information I provide. Separate confirmed facts, assumptions and suggestions. Never invent figures, source claims, commitments or policy. Ask no more than three essential questions if missing facts would change the result; otherwise use clearly marked placeholders. Keep language plain. Remove or mask personal and confidential information before use.

Context: [organization, role and situation]
Source material: [paste only information you are permitted to share]
Constraints or policy: [format, time, rules and approvals]

Stage 3 — Produce and review
Write a runbook with purpose, symptoms, severity cues, safe checks, decision points, escalation contacts by role, communication update, rollback/recovery confirmation and revision owner.

Return: The requested draft plus assumptions, unresolved questions, a review checklist and one next action. Do not hide uncertainty. Mark missing facts as questions or placeholders.
Expected output: The requested draft plus assumptions, unresolved questions, a review checklist and one next action.
Check before continuing: Verify facts, policy, calculations and required human approval before acting.

## Review before using
Do not invent destructive commands, security bypasses or root causes. Keep secrets out. The service owner and security team must approve diagnostics, access and recovery actions before use.

---
Use the result as a draft. Review it for accuracy, context and any required approvals.