[JeremyFunk]

Guide at /guides/incident-response: "Incident response, step by step".

What the page covers

• Plain definition of incident response and the incident response lifecycle
• Lifecycle diagram: the four NIST SP 800-61 Rev. 2 phases, the SANS steps inside each, the containment-to-analysis loop and the post-incident-to-preparation loop. Rev. 3 (April 2025, CSF 2.0 functions) in the text
• Incident response steps for on-call (detect, triage and declare, mitigate, communicate, resolve, review), each badged with its NIST phase
• Severity table SEV1 to SEV4, one color per level; incident roles
• Worked checkout incident: timeline colored by phase, and a chart of where the MTTD, MTTA, MTTM and MTTR clocks start and stop
• Blameless postmortem template (highlighted, markdown mode added to guide-highlight.ts)
• Maple: alert rule templates, severity, Test rule, destinations, incident open/resolve, Waiting on data, History tab, MCP incident tools. Three screenshot slots (/screenshots/guides/incident-response-0{1,2,3}-*.webp), captured separately
• FAQ: incident response steps, lifecycle phases, NIST vs SANS, SEV1, postmortem contents, MTTA vs MTTR

Colors: the four NIST phases use the cool chart colors (purple, blue, teal, green) everywhere on the page; severities use the warm severity colors and nothing else does.

Search intent

People looking up the steps or phases of incident response (often the NIST and SANS versions), plus a practical on-call process with severity levels and a postmortem template.

Maple docs linked

• /docs/alerting/alert-rules
• /docs/alerting/incidents
• /docs/alerting/notification-destinations
• /docs/reference/mcp

Sources

• NIST SP 800-61 Rev. 2: https://csrc.nist.gov/pubs/sp/800/61/r2/final
• NIST SP 800-61 Rev. 3: https://csrc.nist.gov/pubs/sp/800/61/r3/final (published April 2025, supersedes Rev. 2; verified 2026-10-20)
• SANS Incident Handler's Handbook: https://www.sans.org/white-papers/33901
• Google SRE book, Managing Incidents: https://sre.google/sre-book/managing-incidents/
• Google SRE book, Postmortem Culture: https://sre.google/sre-book/postmortem-culture/

No runnable code on the page; the only code block is the Markdown postmortem template. Built with bun run --cwd apps/landing build and checked at 1440 px and 390 px.

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge
A static Astro guide page with no logic; every product claim and doc link it makes checks out against the repo.
_{no findings · tests not needed · risk low}

Adds the /guides/incident-response landing guide, its entry in the guides index and in llms.txt. Static content only, and every claim and link it makes checks out; safe to merge.

• New incident-response.astro guide page with NIST/SANS phase table, severity table, worked timeline and postmortem template
• /guides/incident-response added to investigationGuides in the guides index
• Listing added to the Guides section of llms.txt

Production impact

Production traffic of the changed files (last 7 days)

File	Calls/day	Busiest operations
apps/landing/src/pages/guides/incident-response.astro	131k	maple 131k/day, 92.9% err

What was checked

• Timeline metrics quoted on the page (2/3/18/39 min) recomputed from the 14:02-14:45 stamps: correct
• All linked docs exist (content/docs/alerting/*, errors/overview, reference/mcp)
• Fields the page names (dedup_key, Waiting on data, get_incident_timeline) exist in code and docs

_{5f81d80 · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}

[devin-ai-integration]

🔍 Devin Review: 1 flag

Not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 55 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 40e0b37b-b012-48b0-afc6-e0200dab260e

📥 Commits

Reviewing files that changed from the base of the PR and between e71f8b9 and b0c0a5e.

📒 Files selected for processing: 7

• apps/landing/public/screenshots/guides/incident-response-01-rule.webp
• apps/landing/public/screenshots/guides/incident-response-02-active-incident.webp
• apps/landing/public/screenshots/guides/incident-response-03-history.webp
• apps/landing/src/lib/guide-highlight.ts
• apps/landing/src/pages/guides/incident-response.astro
• apps/landing/src/pages/guides/index.astro
• apps/landing/src/pages/llms.txt.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[maple-review-bot]

Maple review

🟢 Confidence 8/10 · likely safe to merge
Held at 8 because a warning is open.
_{1 warning −1 · tests not needed · risk low}

Adds a static incident-response guide page plus a markdown mode in the guide highlighter, its guides-index entry and its llms.txt line. Content and markup are sound, but three product screenshots the page embeds are not in the repository.

• New markdown tokenizer in guide-highlight.ts highlights the postmortem template
• /guides/incident-response renders lifecycle diagram, severity table, timeline and four clocks
• Guide added to guides/index.astro and llms.txt.ts

Before merge

• Manual · Add incident-response-01-rule.webp, -02-active-incident.webp and -03-history.webp under apps/landing/public/screenshots/guides/

Findings

🟠 Warning · F1 · Guide links three incident-response-*.webp screenshots that are not in the repo

correctness · apps/landing/src/pages/guides/incident-response.astro:485

apps/landing/public/screenshots/guides/ holds only the three prometheus-metrics-* files, and no incident-response-0*.webp exists anywhere at the head, so the three <figure> images here (this line and apps/landing/src/pages/guides/incident-response.astro:500 and :508) render broken on the live page while their text sits beside an empty box. Commit the captures under apps/landing/public/screenshots/guides/ (the Prometheus guide's pattern), or drop the <figure> blocks until they exist.

🤖 Prompt to fix this finding with an AI agent

Findings from an automated review of commit 97dadea3e6cd7cab4e6ffee9e06ebbd2c94b2595. Verify each one against the current code before changing anything, fix only those that still apply, and keep each fix to the lines it names.

---

F1 · Warning · correctness · apps/landing/src/pages/guides/incident-response.astro:485
Guide links three `incident-response-*.webp` screenshots that are not in the repo
`apps/landing/public/screenshots/guides/` holds only the three `prometheus-metrics-*` files, and no `incident-response-0*.webp` exists anywhere at the head, so the three `<figure>` images here (this line and `apps/landing/src/pages/guides/incident-response.astro:500` and `:508`) render broken on the live page while their text sits beside an empty box. Commit the captures under `apps/landing/public/screenshots/guides/` (the Prometheus guide's pattern), or drop the `<figure>` blocks until they exist.

Production impact

Production traffic of the changed files (last 7 days)

File	Calls/day	Busiest operations
apps/landing/src/pages/guides/incident-response.astro	105k	maple 105k/day, 91.1% err

What was checked

• Markdown rules ran on the real template under bun: headings, <placeholders> and table pipes tokenize correctly
• Every doc link in the page resolves to a file in apps/landing/src/content/docs
• list_alert_incidents and get_incident_timeline exist in apps/ai/src/mcp/tools and reference/mcp.md

_{97dadea · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}

[maple-review-bot]

1 inline note from Maple's review. The score and summary are in the review comment above.

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge
New screenshots now exist with filenames and intrinsic sizes matching the figures; the page is static content with no runtime branch left unverified.
_{no findings · tests not needed · risk low}

Adds the /guides/incident-response landing page with a lifecycle diagram, a severity table, a worked example and a postmortem template, plus a markdown mode in guide-highlight.ts and index/llms.txt links. Safe to merge.

• guide-highlight.ts gains a markdown language for the postmortem template block
• /guides/incident-response renders the lifecycle, steps, severities and Maple walkthrough with three screenshots
• The guide is listed on /guides and in llms.txt

Fixed since the last review

• ✅ F1 · Guide links three incident-response-*.webp screenshots that are not in the repo

Production impact

Production traffic of the changed files (last 7 days)

File	Calls/day	Busiest operations
apps/landing/src/pages/guides/incident-response.astro	98k	maple 98k/day, 90.4% err

What was checked

• All three /screenshots/guides/incident-response-0*.webp references (lines 485, 500, 508) resolve at the head, and each file's real dimensions match its width/height
• Ran the new markdown tokenizer on the template: headings, <placeholder>s, bullets and table pipes render escaped and correct
• --severity-fatal/-error/-warn/-trace and --chart-2..5 are defined in packages/ui/src/styles/tokens.css

_{b0c0a5e · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}