incident-response

Incident Response

Correlate incidents with deployments, assess blast radius, and generate postmortem documents using Harness MCP.

Instructions

Step 1: Establish Scope

Confirm the affected service, environment, and incident details.

Call MCP tool: harness_list
Parameters:
  resource_type: "service"
  org_id: "<organization>"
  project_id: "<project>"

Step 2: Identify the Incident Response Task

Determine which workflow the user needs:

1. Deployment-to-Incident Correlation -- Determine if a recent deployment caused the incident
2. Blast Radius Assessment -- Map affected services and downstream impact
3. Postmortem Generation -- Create a structured postmortem document

Step 3: Correlate Deployment to Incident

Gather from the user:

• Affected service name and environment
• Alert or incident name and start time
• Observed symptoms (error rate spike, latency, outage)

Pull recent deployments:

Call MCP tool: harness_list
Parameters:
  resource_type: "execution"
  org_id: "<organization>"
  project_id: "<project>"
  status: "Success"

For each recent deployment, check:

• Timing: Was the deployment within the incident correlation window (e.g., 2 hours before)?
• Service match: Does the deployed service match or depend on the affected service?
• Change content: What changed in the deployment (config, code, infrastructure)?

Build a deployment timeline:

1. List all deployments to the affected environment in the last N hours
2. Mark the incident start time on the timeline
3. Identify the most likely causal deployment (closest before incident start)
4. Check if a rollback was performed and whether it resolved the issue

Present findings with confidence level: HIGH (deployment matches timing + service), MEDIUM (timing matches but different service), LOW (no deployment correlation found).

Step 4: Assess Blast Radius

Gather from the user:

• Failing service and failure type (outage, elevated error rate, high latency)
• Current error rate or severity
• Environment