how we tell this story is how folks will learn from it.)
- for example, those incidents that happen every third Tuesday of the month
- highlighting these relationships helps us create better models
Zoom in on a person that figured it out, was it a metric that gave a clue? did they remember an email?
you can't make post mortems include everything everyone needs to know, we need to make choices about what we include
- avoid trying to tell the story until after the investigation is done. Do the investigation, hen see how the pieces fit together.
- start with events, not the reasons, create a timeline of raw data (chat logs, config changes, deployments)