> ## Documentation Index
> Fetch the complete documentation index at: https://docs.screenpipe.com/llms.txt
> Use this file to discover all available pages before exploring further.

# reconstruct a support or engineering incident

> Build a bounded incident timeline from screens, logs, calls, and messages while separating observed facts, inference, and unknowns.

{/* https://screenpi.pe */}

screenpipe can help recover the sequence around a customer issue, failed deployment, local error, or debugging session. it is supporting evidence, not a replacement for production logs, database state, billing records, or the affected customer's account.

```mermaid theme={null}
flowchart TD
    A["incident boundary"] --> B["screen, transcript, and message events"]
    B --> C["fact / inference / unknown timeline"]
    C --> D["production-source verification"]
    D --> E["reviewed incident note"]
```

## step by step

<Steps>
  <Step title="stabilize first">
    If the incident is active, follow the operating runbook and contain harm before writing the narrative. do not let retrospective automation delay recovery.
  </Step>

  <Step title="define the incident window">
    Record the earliest known symptom, latest known good state, affected system or customer, and the timezone. search a slightly wider window to capture precursor events.
  </Step>

  <Step title="collect visible events">
    Search exact errors, app names, terminal windows, ticket IDs, deployment identifiers, and meeting terms. preserve the original source app and time for each event.
  </Step>

  <Step title="build three lanes">
    Put directly observed events in **facts**, interpretation in **inferences**, and missing or conflicting state in **unknowns**. correlation is not a proven cause.
  </Step>

  <Step title="verify against authoritative systems">
    Check service logs, release artifacts, Sentry, billing, CRM, database, or account state as appropriate. state clearly when screenpipe history is the only available source.
  </Step>

  <Step title="remove sensitive material">
    Replace tokens, customer payloads, private messages, and personal data with narrow summaries or secure artifact references.
  </Step>

  <Step title="publish the reviewed note">
    Include impact, timeline, confirmed cause if known, recovery, unresolved risk, owners, and follow-up dates. do not claim resolution without a current system read-back.
  </Step>
</Steps>

## timeline prompt

```markdown theme={null}
Reconstruct an incident timeline from this bounded screenpipe data.

Use a table with:
- timestamp and timezone
- observed event
- source app, window, meeting, or message
- evidence state: fact, inference, or unknown
- relevance to impact, cause, or recovery

Then summarize impact, confirmed cause if any, recovery actions, open risks,
and the production sources that still need verification.
Do not convert correlation into causation.
Do not expose secrets or raw customer data.
```

## useful search pattern

```bash theme={null}
export SCREENPIPE_API_KEY="$(npx -y screenpipe@latest auth token)"

curl -H "Authorization: Bearer $SCREENPIPE_API_KEY" \
  "http://localhost:3030/search?q=exact-error-or-ticket-id&start_time=3h+ago&end_time=now&limit=100"
```

<Warning>
  screenpipe may show what an operator saw or typed. it does not by itself prove what a remote service, account, or database did.
</Warning>