Incident Response Runbook

flowchart TD
    A([Alert fires]) --> B{Acknowledge<br/>within 5 min}
    B --> C[Assess severity]
    C --> D{Sev 1?}
    D -->|Yes| E[Open incident channel<br/>page on-call lead]
    D -->|No| F[Investigate]
    E --> F
    F --> G{Mitigation found?}
    G -->|No| H[Escalate to service owner]
    H --> F
    G -->|Yes| I[Apply mitigation]
    I --> J{Service healthy?}
    J -->|No| F
    J -->|Yes| K[Resolve incident]
    K --> L[Write postmortem]
    L --> M([Action items tracked])