Principle
Acting without a cause is how a small incident becomes a large one. If the signals are weak or conflict (a little latency here, a few errors there, a change that does not line up in time), say so.
Do
- Write down what is known and what is not, and the next checks that would separate the possible causes.
- Keep watching for one more alert window.
- Escalate to the owning team if customer impact grows.
Do not
- Do not roll back a release only because it is the most recent change.
- Do not restart services to "clear" an unknown problem.