<metaproperty="og:title"content="Scribe - Spearhead Systems Incident Response Documentation"/>
<metaproperty="og:site_name"content="Spearhead Systems Incident Response Documentation"/>
<metaproperty="og:description"content="A collection of information about the Spearhead Systems incident response process. Not only how to prepare new employees for on-call responsibilities, but also how to handle major incidents, both in preparation and after-work."/>
<metaname="twitter:title"content="Scribe - Spearhead Systems Incident Response Documentation"/>
<metaname="twitter:description"content="A collection of information about the Spearhead Systems incident response process. Not only how to prepare new employees for on-call responsibilities, but also how to handle major incidents, both in preparation and after-work."/>
<p>So you want to be a scribe? You've come to the right place! You don't need to be a senior team member to become a deputy or scribe, anyone can do it providing you have the requisite knowledge!</p>
<p>The purpose of the Scribe is to maintain a timeline of key events during an incident. Documenting actions, and keeping track of any followup items that will need to be addressed.</p>
<p>It's important for the rest of the command staff to be able to focus on the problem at hand, rather than worrying about documenting the steps.</p>
<p>Your job as Scribe is to listen to the call and to watch the incident Slack room, keeping track of context and actions that need to be performed, documenting these in Slack as you go. <strong>You should not be performing any remediations, checking graphs, or investigating logs.</strong> Those tasks will be delegated to the subject matter experts (SME's) by the Incident Commander.</p>
<p>Before you can be a Scribe, it is expected that you meet the following criteria. Don't worry if you don't meet them all yet, you can still continue with training!</p>
<ul>
<li>Excellent verbal and written <strong>communication skills</strong>.</li>
<li>Has <strong>knowledge of obscure PagerDuty terms</strong>.</li>
<p>Read up on our <ahref="../../before/different_roles/">Different Roles for Incidents</a> to see what is expected from a Scribe, as well as what we expect from the other roles you'll be interacting with.</p>
<p>There is no formal training process for this role, reading this page should be sufficient for most tasks. Here's a list of things you can do to train though,</p>
<ul>
<li>
<p>Read the rest of this page, particularly the sections below.</p>
</li>
<li>
<p>Participate in <ahref="https://www.pagerduty.com/blog/failure-friday-at-pagerduty/">Failure Friday</a> (FF).</p>
<p>Scribing is more art than science. The objective is to keep an accurate record of important events that occurred on the call, so that we can look back at the timeline to see what happened. But what exactly is important? There's no overwhelming answer, and it really comes down the judgement and experience. But here are some general things you most definitely want to capture as scribe.</p>
<ul>
<li>The result of any polling decisions.<ul>
<li><spanclass="bad">✘</span> This is not "9 people voted yay, 3 voted nay".</li>
<li><spanclass="good">✓</span> It is "Polled for if we should do rolling restart. <USER_A> is proceeding with restart."</li>
</ul>
</li>
<li>Any followup items that are called out as "We should do this..", "Why didn't this?..", etc.<ul>
<li><spanclass="bad">✘</span> This is not "Why isn't the Support representative on the call?"</li>
<li><spanclass="good">✓</span> This is "TODO: Why didn't we get paged for this earlier?"</li>
</ul>
</li>
</ul>
<h2id="incident-call-procedures-and-lingo">Incident Call Procedures and Lingo<aclass="headerlink"href="#incident-call-procedures-and-lingo"title="Permanent link">#</a></h2>
<p>The <ahref="../../during/during_an_incident/">Steps for Scribe</a> provide a detailed description of what you should be doing during an incident.</p>
<p>Here are some examples of phrases and patterns you should use during incident calls.</p>
<p>At the start of any major incident call, you should start our status stalking bot, so that it will post to the room an update automatically.</p>
<blockquote>
<p>!status stalk</p>
</blockquote>
<p>This will provide the update and allow the IC to see the status without having to keep asking.</p>
<h3id="note-important-actions">Note Important Actions<aclass="headerlink"href="#note-important-actions"title="Permanent link">#</a></h3>
<p>During a call, you will hear lots of discussion happening, you should not be documenting all of this in the chat room. You only want to document things which will be important for the final timeline. It's not always obvious what this might be, and it's usually a matter of judgement. You generally want to note any actions the IC has asked someone to perform, along with the result of any polling decisions.</p>
<blockquote>
<p>Polled for decision on whether to perform rolling restart. We are proceeding with restart. [USER_A] to execute.</p>
</blockquote>
<p>Some actions might seem important at the time, but end up not being. That's OK. It's better to have more info than not enough, but don't go overboard.</p>
<p>Sometimes during the call, someone will either mention something we "should fix", or the IC will specifically ask you to note a followup item. You can do this in Slack by simply prefixing with "TODO", this will make it easier to search for later.</p>
<blockquote>
<p>TODO: Why did we not get paged for the fall in traffic on [X] cluster?</p>
</blockquote>
<p>The post-mortem owner will find these after and raise tasks for them.</p>
<h3id="end-of-call-notification">End of Call Notification<aclass="headerlink"href="#end-of-call-notification"title="Permanent link">#</a></h3>
<p>When the IC ends the call, you should post a message into Slack to let everyone know the call is over, and that they should continue discussion elsewhere.</p>
<blockquote>
<p>Call is over, thanks everyone. Follow up in Slack.</p>
</blockquote>
<p>Don't forget to also stop the status stalking.</p>
