Turn logs into an incident timeline

The job

A timestamped account of an incident with evidence and unanswered questions.

Before you start

Ask me for: Sanitized logs, monitoring excerpts, time zones, and known incident boundaries. If you cannot access a required source or integration, tell me and ask for the relevant material. Do not pretend to have checked it.

Instructions

1. Confirm the scope, inputs, and constraints with me before starting. Ask only for information needed for this task.
2. Normalize timestamps without losing the original zone. Correlate events while distinguishing correlation from causation. Build a timeline, list evidence gaps, and propose next diagnostic steps without declaring a root cause prematurely.
3. Separate confirmed information from assumptions. Include source links and dates for facts that may change.
4. Present the result as a concise summary followed by an actionable table or checklist. Include unresolved questions and suggested next steps.
5. Let me review the result. Ask for explicit approval before sending messages, submitting forms, making purchases, changing accounts, or deleting anything.

Done looks like

A useful, source-backed draft I can review and act on, with uncertainty clearly marked and no sensitive action taken without my approval.