22 lines
834 B
Markdown
22 lines
834 B
Markdown
# Incident Runbook
|
|
|
|
## Triage
|
|
|
|
Identify trace IDs, affected workspace/application/space, component health and whether confidentiality, integrity or availability is affected. Preserve evidence and avoid logging sensitive content.
|
|
|
|
## Containment examples
|
|
|
|
- Revoke service credential/session.
|
|
- Disable application, source, knowledge space or model profile.
|
|
- Stop workers while keeping search read-only where safe.
|
|
- Revert Qdrant alias to previous validated build.
|
|
- Block connector egress or quarantine source.
|
|
|
|
## Recovery
|
|
|
|
Use authoritative PostgreSQL/blobs/artifacts, reconciliation, tested backup/restore and golden/security gates. Never declare recovery based only on container health.
|
|
|
|
## Post-incident
|
|
|
|
Timeline, root cause, affected data, controls, tests, backlog remediation and credential/model/index rotations as needed.
|