Template description
Monitoring alert triggers feeds the Impact level diamond. Critical spins up an incident squad. Moderate/Low assigns a responder. Those two boxes both enter Execute mitigation, so severity changes who arrives, not which box does the work. Validate effect is the next split. Recovered closes the incident, then runs Post-incident review, then Publish learnings. Still broken engages leadership and returns to Execute mitigation. Leadership is not a separate ending. The incident stays open, and the next validation can still recover or loop again. Learnings are published only on the recovered side, after the review, not from the leadership arrow.
When to use it
Use it on a handover between a night operator and an incident lead who disagree about whether a moderate alert deserves a squad. It also settles the argument that a broken mitigation should skip the review and go straight to a write-up. In this picture the write-up hangs off Close incident.
How to adapt it
Replace Critical and Moderate/Low with your severity names, and say who sits in the squad. If leadership should be able to close without another mitigation pass, draw that arrow. If learnings must be published even when the incident is still broken, connect Publish learnings to that loop as well. Keep the merge at Execute mitigation unless different severities truly follow different fixes.