Incident postmortem reports

Identifies incident postmortems and post-incident reviews with populated incident detail: timestamped timeline entries, incident/problem references, impact metrics or affected hosts. Generic "timeline", "root cause" and "lessons learned" wording no longer matches.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: postmortem wording is discovery-only; enforcement requires timeline, reference, metric or host structure, and 85 adds a second structure and findings context.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security, technology
Scope: wide
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:(?:incident|outage|blameless)\s+post[\s-]?mortems?|post[\s-]?mortem\s+(?:report|review|document|analysis)\s+(?:for|of|on)\s+(?:the\s+)?(?:incident|outage|INC)|post[\s-]incident\s+(?:review|report|analysis)|PIR\s+(?:report|document)|incident\s+retrospective|root\s+cause\s+analysis\s+(?:report\s+)?for\s+(?:the\s+)?(?:incident|outage|INC))\b

Corroborative evidence keywords

contributing factor, corrective action, action item, detection gap, lessons learned

Proximity: 300 characters

Should match

Incident postmortem - payments outage (blameless) Incident ID: INC0048213 Duration: 47 minutes Customers affected: ~1,900 Timeline (AEST): 09:02 - Deploy of payments-api 2.14.0 to pay-app03.example.internal 09:06 - Error rate alert fired in the monitoring console 09:49 - Rollback completed and service restored Contributing factor: connection pool limit halved in the new release. Corrective action: add a pool-size check to the release pipeline (owner: Platform team). — High tier (85) - incident reference, impact metrics, timeline entries and host with contributing factor/corrective action
Post-incident review for the email outage - Incident ID: INC0051190, service restored after the relay swap. — Medium tier (75) - incident reference only
Outage postmortem notes: time to detect: 22 minutes because the alert was muted. — Medium tier (75) - impact metric only
The post-incident review meeting is booked for Tuesday. — Discovery tier (65) - postmortem wording only

Should not match

The project timeline slipped by two weeks. — Generic timeline wording is no longer a primary
The coroner ordered a post-mortem examination. — Medical post-mortem
Guidance note: a good post-incident review records a timeline, contributing factors and corrective actions. — Guidance text
Postmortem report template Incident ID: ______ Duration: ______ 00:00 - ______ — Blank template
Training module: this mock incident postmortem walks through an outage at 09:00 - Alert fired, Duration: 30 minutes. — Training/mock framing must not enforce

Known false positives

SRE guidance, postmortem-writing templates and training describe timelines and corrective actions. Mitigation: Postmortem wording is discovery-only; enforcement needs populated structure, and guidance/training/mock/template framing is excluded.
Medical/coronial post-mortem examinations. Mitigation: Primary requires incident/outage/blameless context or an incident reference after postmortem report/review.