<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-incident-retrospective-automation
description: >-
  Automate the collection, analysis, and distribution of incident
  retrospective data including timeline generation, action item tracking,
  trend analysis, and organizational learning metrics.
domain: cybersecurity
subdomain: incident-management
tags:
  - retrospective
  - post-mortem
  - automation
  - lessons-learned
  - continuous-improvement
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.IM-1", "RS.IM-2", "RS.AN-5"]
  frameworks: ["NIST SP 800-61", "Google SRE Postmortem Culture"]
---

# Implementing Incident Retrospective Automation

## Overview

Automated retrospectives eliminate the manual burden of post-incident
reviews while ensuring consistent data collection and follow-through on
action items. Automation captures timeline data from tools, generates
draft retrospective documents, tracks remediation actions, and surfaces
trends across incidents.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Incident management platform | Source of incident records and timelines |
| Communication logs | Slack/Teams channels for timeline extraction |
| Action item tracker | Jira/Linear for remediation tracking |
| Template repository | Standardized retrospective format |

## Key Concepts

### Retrospective Pipeline

```
INCIDENT CLOSED
       │
       ▼
┌──────────────┐    ┌──────────────┐    ┌──────────────┐
│ Timeline     │───▶│ Draft        │───▶│ Review       │
│ Extraction   │    │ Generation   │    │ Scheduling   │
└──────────────┘    └──────────────┘    └──────┬───────┘
                                               │
┌──────────────┐    ┌──────────────┐    ┌──────▼───────┐
│ Trend        │◀───│ Action Item  │◀───│ Retrospective│
│ Analysis     │    │ Tracking     │    │ Meeting      │
└──────────────┘    └──────────────┘    └──────────────┘
```

### Blameless Retrospective Format

```
RETROSPECTIVE — INC-{ID}
├── SUMMARY: What happened (factual, 2-3 sentences)
├── IMPACT: Business impact metrics
├── TIMELINE: Auto-generated from tool logs
│   ├── Detection time
│   ├── Response time
│   ├── Containment time
│   └── Resolution time
├── CONTRIBUTING FACTORS
│   ├── What conditions allowed this?
│   └── What made detection/response slower?
├── WHAT WENT WELL
│   └── Effective response actions to reinforce
├── ACTION ITEMS
│   ├── Preventive (stop recurrence)
│   ├── Detective (catch it faster)
│   └── Process (improve response)
└── METRICS
    ├── MTTD, MTTR, MTTC
    └── Comparison to baseline
```

### Trend Categories

| Trend | Metric | Target |
|-------|--------|--------|
| Recurrence | Same root cause repeat rate | < 5% |
| Action completion | Items closed on time | > 90% |
| MTTR improvement | Quarter-over-quarter | -10% |
| Detection gap | Incidents found externally | < 20% |

## Workflow

1. Auto-extract timeline from incident management platform
2. Pull communication logs from response channels
3. Generate draft retrospective document
4. Schedule retrospective meeting with participants
5. Capture action items with owners and due dates
6. Track action item completion
7. Aggregate trends across retrospectives quarterly

```bash
# Generate retrospective draft from incident data
node agent.js generate --incident-id INC-2026-0200

# Track action items for a retrospective
node agent.js track-actions --incident-id INC-2026-0200

# Analyze trends across retrospectives
node agent.js analyze-trends --period quarterly
```

## Verification

- [ ] Retrospective generated within 3 days of incident closure
- [ ] Timeline automatically extracted from tool logs
- [ ] All action items have assigned owners and due dates
- [ ] Action item completion rate tracked and reported
- [ ] Quarterly trend report generated automatically

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- NIST SP 800-61
