S.A.M.P.L.E. Investigation

What to look for: Observable indicators of the incident. Document exactly what users are experiencing and what the system is showing. Include error messages, performance issues, service outages, or unexpected behavior.

What to look for: Known sensitivities, configurations, or dependencies that could affect the problem or potential solutions. Consider software versions, hardware limitations, security policies, and system interdependencies.

What to look for: Specific modules, components, or parts of the system that are affected. Identify whether it's UI, data layer, web/application servers, or other processes. Pinpointing affected modules provides crucial insights into potential causes.

What to look for: Similar incidents that occurred before. Check incident logs, knowledge base articles, and problem records. Finding previous occurrences can provide quick resolution paths and prevent repeating past mistakes.

What to look for: The last known good state and any recent changes. Identify when the system last worked properly and what modifications occurred since then. This could be the root cause of the incident.

What to look for: The sequence of events that led up to the incident. Reconstruct the timeline of actions, alerts, and system behaviors. Understanding the chronological flow helps identify triggers and causal relationships.