Incident timeline calculator

Calculate response intervals from incident timestamps, with UTC-normalized output and room for uncertain onset.

Free to use. Save a file draft or explicitly enable storage on this device.

Current result

Detection: Unknown min

Incomplete or uncertain. Review the fields and warnings.

Review results

Start with your data or try an illustrative example.

Draft nameUsed in downloaded filenames.

Save on this device while I work

File drafts are available without browser storage. Current draft matches the last save or initial state.

This draft contains illustrative or practice data

Inputs & calculation

Offset for timestamps without a zoneFixed offset, not a daylight-saving rule. A pasted Z or ±HH:mm overrides it for that timestamp.

Impact beganTimestamp for impact beganEvidence for impact began

Incident detectedTimestamp for incident detectedEvidence for incident detected

Page acknowledgedTimestamp for page acknowledgedEvidence for page acknowledged

Investigation beganTimestamp for investigation beganEvidence for investigation began

Mitigation appliedTimestamp for mitigation appliedEvidence for mitigation applied

Service recoveredTimestamp for service recoveredEvidence for service recovered

Onset is uncertain: enter observation bounds

Leave exact onset blank when it is not known. Use the earliest and latest plausible onset supported by your evidence.

Earliest plausible onsetLatest plausible onset

Detection: Unknown min
Acknowledgment: Unknown min
Detection to investigation: Unknown min
Investigation to recovery: Unknown min
Total impact: Unknown min

Mitigation attempts

Keep unsuccessful attempts as well as the eventual mitigation. Each outcome helps explain the response sequence without overwriting its milestone timestamps.

Incident worksheetRecord impact, affected population, response owner, recovery checks and unresolved risks.

Results

Review and export

This is incomplete or has review issues. You can save a draft; exports retain unknowns and warnings.

Incident timeline report

Incident timeline
User-entered draft; verify against source evidence.
Tool version 2 · https://aiopssre.com/incident-timeline-calculator/
Name: Untitled

Detection: Unknown minutes
Acknowledgment: Unknown minutes
Detection to investigation: Unknown minutes
Investigation to recovery: Unknown minutes
Total impact: Unknown minutes

Incident notes: 
Single-incident durations are not means. Bounds reflect supplied observations, not a probability interval.

Milestone / attempt	Original timestamp	UTC timestamp	Evidence / outcome
Impact began		Unknown
Incident detected		Unknown
Page acknowledged		Unknown
Investigation began		Unknown
Mitigation applied		Unknown
Service recovered		Unknown

Continue the incident workflow

Carry incident notes and the timing report into a follow-up action draft. Transfer uses this browser tab’s temporary storage, not a shared URL.

What the intervals measure

Detection runs from impact onset to first discovery. Acknowledgment, investigation, mitigation and recovery mark different parts of the response, so enter the evidence for each separately. If onset is uncertain, leave the exact field blank and enter the earliest and latest times supported by the record. Discovery at 10:10 with onset between 10:00 and 10:06 gives a detection range of four to ten minutes.

Finding a delay in the response

The worked example records an unsuccessful mitigation at 10:18 and another at 10:22, followed by recovery checks at 10:30. Keeping both attempts shows what responders tried; replacing the first timestamp with the second would hide part of the investigation. The report can point you to that sequence for review, but timestamps alone cannot show which action restored service. Use the MTTD calculator when you have several comparable incidents to aggregate.

Read the accompanying guide · Source and further reading

Calculation and worksheet review: September 29, 2026.

Full Incident Response Toolkit · Get new guides by email