How to Set Up an Incident Response Workflow in Linear
Incidents are inevitable; chaos during incidents is not. The teams that resolve incidents quickly are not the ones with the best engineers; they are the ones with the best process. When a production issue hits, every second spent figuring out who to page, where to communicate, and how to track progress is a second where users are impacted. Linear's workflow features can encode your incident response process so the team follows a structured playbook rather than improvising under pressure.
This guide sets up an incident management system in Linear that covers the full incident lifecycle: detection, triage, response, resolution, and post-mortem. The PM's role in incidents is not to debug, but to coordinate communication, prioritize user impact, and ensure that lessons learned feed back into the product roadmap.
Step-by-step guide
Create a dedicated Incident Response team in Linear
Create a Linear team called 'Incidents' that is separate from your feature delivery teams. This team uses a custom workflow with states specific to incidents: Detected, Triaging, Responding, Mitigated, Resolved, and Post-Mortem. Disable cycles on this team because incidents are not sprint work. Add all engineers who participate in on-call rotation as team members. This separation keeps incident work visible without cluttering your sprint boards.
- Create the Incidents team with custom workflow states
- Disable cycles since incidents are not planned work
- Add on-call engineers and the PM as team members
Define severity labels and SLA targets
Create labels for incident severity: SEV-1 (critical: product down for all users, data loss), SEV-2 (major: significant feature broken for many users), SEV-3 (moderate: feature degraded for some users), SEV-4 (minor: cosmetic issue or workaround available). For each severity, define response time and resolution time SLAs. SEV-1 might be 'respond in 5 minutes, mitigate in 1 hour.' SEV-3 might be 'respond in 4 hours, resolve in 3 days.' Document these in the team description.
- Create SEV-1 through SEV-4 labels with clear definitions
- Define response and resolution SLAs for each severity level
- Document severity definitions and SLAs in the team description
Create an incident issue template
Build a Linear issue template for incidents with pre-filled sections: Impact Summary (who is affected and how), Detection Source (monitoring alert, user report, internal discovery), Current Status (updated as the incident progresses), Timeline (chronological log of actions taken), Root Cause (filled during or after resolution), and Action Items (preventive measures identified during the post-mortem). The template ensures that incident documentation happens in real time rather than being reconstructed after the fact.
- Create the template with all standard incident sections
- Include a timeline section for chronological action logging
- Add placeholders for root cause and action items
Set up automated triage and notification
Configure Linear automations to streamline the first minutes of an incident. When an issue is created in the Incidents team, auto-assign it to the current on-call engineer (use a rotating label or integration with PagerDuty/Opsgenie). Create a Slack integration that posts a new message in #incidents when an issue is created, including the severity label, impact summary, and a link to the Linear issue. For SEV-1 incidents, trigger an additional notification to the engineering manager and PM.
- Set up auto-assignment to the on-call engineer
- Configure Slack notifications for new incidents with severity-based routing
- Add escalation notifications for SEV-1 incidents
Establish the post-mortem workflow
When an incident moves to Resolved, automatically create a linked 'Post-Mortem' sub-issue in the same team. The post-mortem template should include: Incident Summary, Timeline of Events, Root Cause Analysis (use the 5 Whys framework), Impact Assessment (users affected, duration, revenue impact), What Went Well, What Went Poorly, and Action Items (each linked to a follow-up issue in the relevant feature team). Schedule the post-mortem meeting within 48 hours of resolution while context is fresh.
- Auto-create a post-mortem sub-issue when incidents are resolved
- Include the 5 Whys framework in the post-mortem template
- Link action items to follow-up issues in feature teams
Track incident metrics and trends
Use Linear's filtering and export capabilities to track incident metrics monthly. Key metrics: number of incidents by severity, mean time to detection (MTTD), mean time to resolution (MTTR), percentage of incidents with completed post-mortems, and number of action items completed versus created. Review these metrics monthly in your engineering leadership sync. A rising MTTR or a growing backlog of incomplete action items signals process decay.
Common mistakes
Skipping the post-mortem for low-severity incidents
SEV-3 and SEV-4 incidents often share root causes with future SEV-1 incidents. A minor issue that recurs weekly is a major issue waiting to happen. Run lightweight post-mortems for all severities: a 15-minute review is sufficient for SEV-3/4, but the root cause analysis should still happen.
Using incidents as a blame tool
If post-mortems assign blame, engineers will underreport incidents and avoid documenting root causes. Frame incidents as system failures, not human failures. The question is 'what in our system allowed this to happen?' not 'who made this mistake?' This creates a culture where incidents are learning opportunities.
Not following up on post-mortem action items
A post-mortem that generates action items that never get prioritized is theater. Link every action item to a real issue in the relevant team's backlog and track completion rate. If action items consistently go unfinished, either the items are not important enough (revise your post-mortem) or they are not being prioritized (escalate to leadership).
Tips
Create a 'War Room' Slack channel template that gets created for each SEV-1 incident, centralizing real-time communication during the response
Use Linear's Relations feature to link incidents to the feature issues or deploys that caused them, building a traceable chain from change to impact
Set up a monthly 'Incident Review' where the team walks through all incidents from the past month, looking for systemic patterns rather than individual issues
Add a 'Customer Communication' checkbox to the incident template so the PM ensures affected customers are notified during or after the incident
How Vantage helps
Vantage syncs with Linear bidirectionally, so incidents tracked in Linear are visible in your project workspace. When an incident reveals a product gap, you can create a new project in Vantage directly from the post-mortem action items, carrying the incident context into the PRD. This ensures that incident learnings become product improvements, not just engineering patches.