post-incident-analysis

Reconstruct incident timelines and generate post-incident analysis reports from ServiceNow Security Operations records.

34|13|Updated Feb 6, 2026

Search Tags:#secops #audit-trail #timeline-reconstruction #lessons-learned #incident-reporting #post-incident-analysis

Ready to run

npx skills add https://github.com/Happy-Technologies-LLC/happy-servicenow-skills --skill post-incident-analysis

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: post-incident-analysis
Source: https://github.com/Happy-Technologies-LLC/happy-servicenow-skills/tree/main/skills/secops/post-incident-analysis
Command: npx skills add https://github.com/Happy-Technologies-LLC/happy-servicenow-skills --skill post-incident-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a structured, repeatable process to perform post-incident analysis (PIR) for closed security incidents, reconstructing timelines, identifying detection and response gaps, and documenting lessons learned.

Core Features & Use Cases

Timeline reconstruction from incident records, work notes, and audit logs to reveal the sequence of events.
Metrics calculation (time to detect, triage, contain, eradicate, recover) and generation of actionable improvement recommendations.
PIR reporting for management, compliance, and knowledge capture, including executive summaries and root-cause documentation.

Quick Start

Load a closed security incident into the PIR workflow and generate a complete PIR report.

Frequently Asked Questions about post-incident-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I perform a post-incident analysis on closed security incidents in ServiceNow?▼

Post-incident analysis in ServiceNow is performed by loading a closed security incident into a PIR workflow, which gathers data from incident records, work notes, and audit history to generate a formal report. It uses MCP and REST interfaces to assemble and verify findings.

What is the best way to reconstruct an incident timeline from audit trails and work notes?▼

Reconstructing an incident timeline is best achieved by extracting chronological data from audit history and work notes to reveal the exact sequence of events. This process identifies detection and response gaps to produce actionable lessons learned.

How do I calculate response metrics like time to detect and contain for security incidents?▼

Calculating time to detect, triage, contain, eradicate, and recover is done by analyzing the timestamps in incident records and audit logs within the PIR workflow. This calculation generates actionable improvement recommendations for future response efforts.

Does this post-incident analysis workflow require specific dependencies to function?▼

The post-incident analysis workflow operates without external dependencies, relying entirely on native ServiceNow Security Operations data. It uses MCP and REST interfaces to gather incident records, work notes, audit history, and tasks to verify findings.

Can I generate executive summaries and lessons-learned documentation from ServiceNow incident records?▼

Generating executive summaries and lessons-learned documentation is a core feature of the PIR workflow applied to closed ServiceNow incidents. It automatically formats root-cause documentation and improvement recommendations for management and compliance review.