Escalation and Handoff
The difference between a smooth escalation and a dropped ball is one well-written paragraph.
What you will learn
- -Decide when to escalate versus keep working an alert
- -Write an escalation that a Tier 2 analyst can act on without asking you anything
- -Hand off an open case at end of shift so nothing gets dropped
A Tier 2 analyst gets pinged at 2am with a ticket that says "suspicious activity on , please look." That is useless. They now have to reconstruct everything you already knew, half-asleep, while the attacker keeps working. The whole point of escalation is to transfer your understanding, not just the problem. A bad handoff throws away the twenty minutes you spent and starts the clock over.
Escalation is moving an to someone with more access, more authority, or more time, because it is past what you can or should handle at your tier. the timing right and the response is fast. Get it wrong in either direction and you either flood Tier 2 with noise or sit on a real breach too long.
Know when to escalate
Escalate when you have confirmed something real that exceeds your tier. A you cannot fully . Anything touching a critical like a or a payments . Signs of active lateral movement or data leaving the . When in genuine doubt about whether it is real and the potential is high, escalate. A false alarm sent up costs a few minutes. A missed breach held back costs the company.
Do not escalate to dodge work. If it is a routine alert you can close with a bit more digging, close it. Kicking easy tickets upstairs burns Tier 2's time and, worse, it trains them to distrust your escalations. The point is judgment, not reflex in either direction.
Write it so they can act cold
A good escalation answers the questions the next analyst will ask before they ask them. Assume they know nothing about this alert and are tired.
$What fired: T1003 LSASS access alert, WKSTN-14, user jsmith, 02:14 UTC$Why it is real: parent proc is a macro-enabled Word doc, not a normal admin tool$Scope so far: only WKSTN-14 seen, checked FS01 and DC01, clean as of 02:30$Done + next: host isolated in Defender, recommend jsmith password resetThose four lines let a Tier 2 analyst act in the first minute instead of interviewing you. What fired, why it is real, what you have scoped, and what you already did. Attach the raw and the ticket link so they can verify rather than take your word for it. Precision here is the whole skill.
If you isolated a machine, killed a process, or reset a during , that goes in the escalation in plain words. The next analyst has to know the current state of the system before they act, and they must stay inside authorized scope too. An undocumented step can look like the attacker moving, or destroy the evidence trail. Record what you touched and when.
The end-of-shift handoff
Escalation moves one alert up. A handoff moves your whole open workload sideways to the next shift, and it is where cases go to die if you are sloppy. When you clock out, the incoming analyst needs a short brief: what is still open, what you are mid-investigation on, and anything that needs eyes soon.
Keep it to the live items. "Case 4471 open, likely phishing wave from marketing-themed sender, three confirmed clicked, waiting on email security to pull the campaign, check back at 08:00." That one sentence keeps a real investigation moving across a shift boundary instead of stalling for eight hours because you went home. Put it in the case system, not a chat message that scrolls away.
An escalation lists what fired, why it looks real, and the scope checked so far, but the receiving analyst still has to message you to ask one thing before they can safely act. What did you leave out?
Think about the current state of the host. Before they touch it, they need to know what you already did to it, like isolating it or killing a process.