Build a CSIRT and SOC Escalation Handoff

Lab Objective

Practise the human workflow of a security incident: triage an alert, escalate it with context, assign technical and coordination responsibilities, and produce a concise management update.

Use a fictional organisation and synthetic data. This is not a real incident.

Scenario

A monitoring tool reports an unusual SSH login to a fictional server. The alert contains a timestamp, a synthetic source address, a username, and a host identifier. No conclusion has been made yet.

Procedure

1. L1 triage: record the alert source, time, asset, account, initial severity, and the exact reason it was raised.
2. Evidence check: list what is known, what is missing, and which log or owner could confirm each missing fact.
3. L2 investigation: compare nearby authentication events, expected maintenance windows, and the account's normal activity. Record evidence, not guesses.
4. L3 or technical-lead decision: decide whether containment is warranted in the fictional environment and document the reason, scope, and rollback path.
5. Incident coordination: write a handoff that identifies technical owners, business stakeholders, communication needs, and the next review time.
6. Manager update: produce a short status report with impact, current confidence, actions taken, open risks, and next decision.

Expected Evidence

The completed exercise should contain one ticket or Markdown record with:

• a timeline;
• the original observation;
• investigation steps and results;
• an explicit confidence or uncertainty statement;
• the reason for escalation;
• named fictional roles for technical lead, incident coordinator, and manager;
• a next action and owner.

Security Takeaway

Escalation is not a status ladder. It is a transfer of context and authority. If the next role receives only “high severity,” the process has moved the alert but not the investigation.