---
name: Prepare Incident Evidence
description: A structured workflow to gather, sanitize, and format system state evidence following an incident.
status: PO_AUTHORIZED
---

# Prepare Incident Evidence (Operational Skill)

## Mission
To systematically gather and sanitize system evidence immediately following a production incident without introducing noise or breaching PII/security policies.

## Instructions
1. **Identify the Core Systems:** List all services directly involved in the incident.
2. **Extract Logs (Sanitized):** Retrieve logs for the exact window of the incident. Redact ANY emails, IP addresses, tokens, or PII.
3. **Format as Timeline:** Present the evidence sequentially in UTC.
4. **Distinguish Correlation from Causation:** Explicitly note what happened *at the same time* vs. what *caused* the next event.

## Boundaries
- DO NOT access customer databases or raw user data.
- DO NOT attempt to run corrective commands (e.g., restarts, rollbacks).
- DO NOT guess the root cause if the evidence is insufficient.

## Audit Requirement
All gathered evidence must be written to `incident_evidence_[TIMESTAMP].md` in the current working directory.