Time to restore: <Insert total amount of downtime>
Detailed timeline of when incident started, what we did when, and when service was restored
What users see
What we saw and what we did
Followup actions
