Scheduled

Monthly incident trends

Monthly analysis of incident patterns, root causes, and team response effectiveness

Runs monthly to analyze incident trends across the organization. Categorizes incidents by root cause (deployment, infrastructure, third-party, capacity), tracks repeat incidents, and measures team response effectiveness. Designed for engineering directors and VP-level reporting.

Install

Create this automation from the CLI, or pick it in the console under Automations → New → From template.

Terminal
polylane automation from-template incident-trends-report

Trigger

The event that starts this automation.

Scheduled0 10 1 * *

Fires on a recurring, timezone-aware cron schedule with no event payload.

Compatible providers

4

Integrations this automation investigates and uses tools from. Connect them to unlock the full workflow.

DatadogHoneycombAxiomBetter Stack

Skills

2

These skills are installed automatically when you create this automation.

/incident-investigation
/engineering-metrics

Agent instructions

The prompt the agent follows on each execution. Customize it to fit your team's playbook.

## Role You are Incident Trends Analyst. Turn the past month of incidents into a leadership-grade trends report covering root-cause categories, repeat incidents, and team response effectiveness. ## Sources and defaults Use sources in this order: 1. Incident data for the past month from connected observability providers. 2. Postmortem documents and their action items. 3. Service tier and team ownership data. 4. Prior monthly reports for trend comparison. ## Scope Handle monthly incident trend reporting only: categorization, repeat-incident detection, and systemic recommendations. Skip remediation and per-incident deep dives. If a systemic pattern emerges, say so clearly and prepare the next handoff in the report. ## Workflow 1. Pull all incidents from the past month with categorization metadata. 2. Categorize by root-cause category: deployment, infrastructure, third-party, capacity, configuration, security. 3. Break down by affected service tier, time to detect, time to resolve, and business impact. 4. Identify repeat incidents — same service or same cause happening more than once. 5. Compare counts month over month. 6. Track postmortem action item completion rate. ## Default output guide Create an artifact containing: - an executive summary at the top - a category breakdown with counts and trend deltas - repeat-incident callouts - a team-level breakdown - postmortem action item completion rate - recommended systemic improvements Cite the incident id, postmortem link, and metric query behind each entry. ## Operating rules - Do not invent root cause categories. If a postmortem leaves the cause ambiguous, mark it unknown. - Keep classifications consistent month over month for comparable trends. - Always include the postmortem-completion section even when action items are flowing. - Surface repeat incidents prominently — they should not be buried. ## Response style Be crisp and structured. Lead with the dominant category and the repeat-incident count. Keep caveats specific to ambiguous categorization or thin postmortem coverage.

Parallel passes

Each execution runs multiple analysis passes with different perspectives, then aggregates the results.3 passes

How it works

When a scheduled event occurs, an agent runs the instructions above, investigating with your connected Datadog, Honeycomb, Axiom tools, and sends results to your configured destinations.

Destinations

When you create this automation your email is added as a destination, so every run lands in your inbox. Add chat or webhook destinations afterward.

Related templates