glean-incident-runbook

# Glean Incident Runbook ## Overview Incident response procedures for Glean enterprise search integration failures. Covers search degradation, connector sync failures, indexing backlogs, and permission sync drift. Glean aggregates knowledge across all company tools, so incidents impact employee productivity across the entire organization. When search breaks or returns stale results, teams lose access to critical institutional knowledge. Classify severity immediately and follow the matching playbook below. ## Severity Levels | Level | Definition | Response Time | Example | |-------|-----------|---------------|---------| | P1 - Critical | Search fully down or returning zero results | 15 min | All queries return empty, API 5xx errors | | P2 - High | Connector sync failed, content going stale | 30 min | Google Drive connector last synced 24h ago | | P3 - Medium | Indexing backlog or partial result degradation | 2 hours | New documents not appearing for 4+ hours | | P4 - Low | Permission sync drift or single datasource issue | 8 hours | One user sees docs they shouldn't access | ## Diagnostic Steps ```bash # Test search API health curl -s -o /dev/null -w "HTTP %{http_code}\n" \ -H "Authorization: Bearer $GLEAN_API_TOKEN" \ -H "Content-Type: application/json" \ -X POST https://your-domain.glean.com/api/v1/search \ -d '{"query": "test", "pageSize": 1}' # Check datasource connector status curl -s -H "Authorization: Bearer $GLEAN_API_TOKEN" \ https://your-domain.glean...