Reconstruct incident timelines from logs, tickets, and monitoring data — identify root cause and MTTR.