Shift handover

Write the notes the next shift needs. It fills in from your cases, and you add the rest.

Why handovers matter

A SOC runs around the clock, so work passes from one analyst to the next. A good handover lets the next person continue without asking you anything. The sections below fill in from your cases. Add what the numbers cannot say.

  • What you closed and why, in one line each.
  • What you escalated, and to whom.
  • What is half done, so nothing is dropped.
  • What to watch: a host, an address, or a pattern that may come back.

For example an IP that was blocked, a user to keep an eye on, or a rule that is noisy.

Things you could not finish or verify, and who you are waiting on.

Handover note

Nothing closed yet. Take an alert and this note fills itself in.

Closed this shift:
- None

Escalated to L2:
- None

In progress:
- None

Still in the queue: 51 alerts
- SL-1021 (critical) Concurrent admin session from multiple IPs
- SL-1022 (critical) New executable file on internet-facing server
- SL-1026 (critical) Suspicious process chain: signed binary spawned rundll32.exe
- SL-1027 (critical) Inhibit system recovery detected
- SL-1036 (critical) DLP: sensitive attachments sent to external domain
- SL-1001 (high) Suspicious email: sender domain similar to internal domain
- SL-1003 (high) Authentication: multiple failures followed by success (SSH)
- SL-1005 (high) Outbound connection to threat-intel listed IP
- SL-1006 (high) Suspicious child process: WINWORD.EXE spawned powershell.exe
- SL-1010 (high) Multiple MFA denials followed by approval
- SL-1011 (high) Storage bucket ACL changed: public access enabled
- SL-1015 (high) Service account: new source IP and bulk data export
- SL-1020 (high) FIM: new script file in web upload directory
- SL-1024 (high) New MFA method registered after admin reset
- SL-1028 (high) Cloud access key used from new IP and new region
- SL-1029 (high) OAuth app consent: new app granted mail access
- SL-1032 (high) User-reported: suspicious phone request for payment
- SL-1033 (high) User-reported phishing: multiple recipients clicked URL
- SL-1040 (high) Volume shadow copies deleted (vssadmin delete shadows)

Watch for:
- Nothing noted

Follow-ups and open questions:
- Nothing noted

Found something confusing or unrealistic?