Incident response runbook

An incident response runbook is a flowchart of what happens in response to an alert: page the primary responder, escalate to secondary if it is not acknowledged in five minutes, and only declare an incident when users are affected. Changes that don't fix the problem are rolled back; otherwise the mitigation is kept and watched. If the improvement doesn't hold for thirty minutes a new hypothesis is formed rather than calling it done.

People draw this one to train a new responder, to agree when something is an incident rather than a ticket, or to show an auditor that paging, declaration, status updates and a postmortem are actually in the path. The loops are important: acknowledgement retries, the mitigation cycle back through a hypothesis, and not closing incidents until they've genuinely been addressed.

Incident response runbook Alertfires Page primaryon-call Ack in 5min? Escalate tosecondary Assess scopeand impact Service runbook Userimpact? Fix in businesshours Noincident Declare anincident Assign incidentcommander Open incidentchannel Status pageupdate Form ahypothesis Telemetry Recentchange? Roll back thechange Apply mitigation Gettingbetter? Monitor for 30minutes Stillgreen? Resolve andupdate status Postmortem draft File actionitems Incidentclosed No Yes guides No Yes informs Yes No Yes Yes No No
Open in editor

Mermaid source

---
title: Incident response runbook
---
flowchart LR
  alert([Alert fires]) --> page[Page primary on-call]
  page --> ack{Ack in 5 min?}
  ack -->|No| esc[Escalate to secondary]
  esc --> ack
  ack -->|Yes| triage[Assess scope and impact]
  book@{ shape: doc, label: "Service runbook" } -. guides .-> triage
  triage --> sev{User impact?}
  sev -->|No| ticket[Fix in business hours]
  ticket --> bau([No incident])
  sev -->|Yes| declare[Declare an incident]
  declare --> ic[Assign incident commander]
  ic --> comms[Open incident channel]
  comms --> status@{ shape: doc, label: "Status page update" }
  comms --> hypo[Form a hypothesis]
  tele[(Telemetry)] -. informs .-> hypo
  hypo --> cause{Recent change?}
  cause -->|Yes| roll[Roll back the change]
  cause -->|No| mit[Apply mitigation]
  roll --> watch{Getting better?}
  mit --> watch
  watch -->|No| hypo
  watch -->|Yes| mon[Monitor for 30 minutes]
  mon --> stable{Still green?}
  stable -->|No| hypo
  stable -->|Yes| resolve[Resolve and update status]
  resolve --> pm@{ shape: doc, label: "Postmortem draft" }
  pm --> actions[File action items]
  actions --> closed([Incident closed])

Stock Mermaid vs Line9 on this incident response runbook

Run the same source through the stock Mermaid engine and it often will not look as good. In some cases, Mermaid is able to deliver a usable graph, but not always. On this one:

The same incident response runbook through stock Mermaid — a band more than eight times wider than it is tall, with the mitigation returns drawn as long reverse edges
Stock Mermaid · same source View full size ↗

The stock Mermaid renderer draws this as a single band more than eight times wider than it's tall, making it impossible to be printed or displayed without wasting lots of space. Even when it is displayed, the aspect ratio requires the diagram to be scaled down to accommodate the width, to the point where label text is too small to read. Line9 lays the same source out at 3.2:1, with the acknowledgement retry sitting above ‘Ack in 5 min?’ and the rollback/mitigation cycle as a compact cluster on the right.

For a fuller product comparison — layout, export, CLI, and pricing — see Line9 vs mermaid.live.

Render your own

Paste any Mermaid flowchart into the free online editor — no account needed. Prefer the terminal? Install the line9 CLI (free for personal use).

More scenarios on the Mermaid examples hub.