Agent Foskett Academy • SOC Analyst Academy • Module 1 • Lesson 9 • Inside the SOC

Lesson 9 — Another Analyst Has to Read Your Notes Tomorrow

You understand the incident because you have spent the last hour investigating it. Tomorrow morning, another analyst may know none of that.

Your notes have to preserve the facts, the reasoning, the pivots you followed, what you ruled out and what still needs to be answered.

If another analyst cannot continue the investigation from your notes, the investigation is not properly documented.

Write the Handover Back to SOC Analyst Academy

SOC analyst investigation documentation and handover

Your shift ends in 20 minutes

The incident is still open. Another analyst will take it tomorrow. They need more than a list of alerts.

✓ Separate facts from assumptions

✓ Record why pivots were followed

✓ Preserve important timestamps and entities

✓ State outstanding questions clearly

Case briefing

16:40 — SHIFT HANDOVER APPROACHING INCIDENT Suspicious privileged account activity CONFIRMED ✓ unusual successful sign-in ✓ PowerShell execution ✓ external network connection ✓ user denied the activity ✓ incident escalated OUTSTANDING ? second device involvement ? persistence ? additional privileged access YOUR SHIFT ENDS AT 17:00 Another analyst takes over tomorrow. WHAT DO THEY NEED TO KNOW?

Investigation objective

Write investigation notes that preserve facts, reasoning and outstanding questions so another analyst can understand the case and continue without repeating your work.

Investigator's rule

Write for the analyst who was not in the room. Do not rely on memory, portal history or unexplained shorthand to carry the investigation forward.

Stage 1 — separate observation from interpretation

Weak note	Better note
User hacked.	User stated they did not recognise the sign-in. Authentication and endpoint evidence remain under investigation.
Bad PowerShell.	powershell.exe executed on ADM-LT-004 at 12:11 with an unexpected command line and subsequent external connection.
Attacker moved laterally.	A second privileged identity was observed from the same source IP. Relationship has not yet been confirmed.
Looks malicious.	Current evidence supports suspected compromise; no validated benign explanation has been identified.

Facts survive handover

Timestamps, entities, command lines, alert IDs and observed actions can be checked by the next analyst. Your confidence and interpretation should be recorded separately.

Do not upgrade uncertainty

If lateral movement is only a hypothesis, write that. Notes become dangerous when “possible” silently becomes “confirmed.”

Stage 2 — record the investigation timeline

11:58 Successful sign-in — privileged.admin@contoso.com 12:11 powershell.exe executed — ADM-LT-004 12:14 PowerShell initiated external connection 12:21 User contacted — activity not recognised 12:34 Second privileged identity observed from same source IP 12:46 Incident escalated to senior SOC / IR 16:40 Investigation remains open — handover prepared

Time creates the story

A chronological note helps the next analyst understand sequence and causality much faster than disconnected observations copied from different portals.

Record the pivot, not every click

Document why you moved from sign-in to device, process to network or IP to another identity. Portal navigation history is not investigation reasoning.

Stage 3 — use KQL to preserve a compact evidence summary

KQL can help create a reproducible snapshot of important events for the handover. The query is not the note; it supports the facts recorded in the note.

12345678910111213

let TargetDevice = "ADM-LT-004";
DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceName =~ TargetDevice
| where FileName =~ "powershell.exe"
| project Timestamp,
          DeviceName,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

Make evidence reproducible

Record useful query logic, filters and time windows when another analyst may need to reproduce the result. “I saw something in Advanced Hunting” is not enough.

Do not paste telemetry without explanation

A hundred rows of raw events can hide the point. Summarise what the evidence demonstrates and preserve the query or identifiers needed to verify it.

Stage 4 — document what you ruled out

Question tested	Result	Status
Was PowerShell launched by approved management software?	No matching approved parent process identified.	Benign explanation not supported
Did the user recognise the sign-in?	No.	Supports further investigation
Was another privileged identity involved?	Observed from same source IP.	Relationship unresolved
Was persistence confirmed?	Not yet investigated fully.	Outstanding

Negative findings matter

If you checked for something and did not find it, record that carefully. The next analyst should not waste time unknowingly repeating the same test.

“Not found” is not “did not happen”

Write the limits of the evidence. No persistence found in the telemetry reviewed is more defensible than declaring that persistence did not occur.

Stage 5 — leave the next analyst a starting point

HANDOVER NOTE STATUS Escalated suspected compromise involving privileged identity. CONFIRMED • unusual successful sign-in • suspicious PowerShell execution • outbound connection • user does not recognise activity CURRENT SCOPE • privileged.admin@contoso.com • ADM-LT-004 • second privileged identity requires validation ACTIONS • senior SOC / IR engaged • evidence timeline preserved OUTSTANDING 1. Validate second privileged account relationship 2. Check persistence mechanisms 3. Review additional privileged sign-ins 4. Determine whether other devices are affected NEXT RECOMMENDED PIVOT Start with the second privileged identity and confirm whether its activity shares the same session/source context.

A good handover tells the next analyst what happened, what you think it means, and exactly where to continue.

Lesson 9 key takeaways

Investigation notes are part of the evidence trail.
Separate confirmed facts from interpretation and hypotheses.
Preserve important timestamps, entities and identifiers.
Record why important pivots were followed.
Document meaningful negative findings without overstating them.
State the limits of the telemetry you reviewed.
Use KQL to make important findings reproducible.
Do not bury conclusions inside raw telemetry dumps.
List outstanding questions explicitly.
Give the next analyst a clear recommended starting point.

Module 1 — inside the SOC

You can now triage, collect evidence, pivot, decide, escalate and document. The final lesson in Module 1 brings the entire workflow together.

Next: Lesson 10 — From Alert to Closure — Your First SOC Investigation

Continue your SOC Analyst training

Module 1 builds the analyst mindset: triage, evidence collection, pivots, stopping rules and escalation.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 1: Inside the SOC: Thinking Like an Analyst

Write investigation notes that preserve facts, reasoning and outstanding questions.

← Previous lesson

Lesson 8 — This One Needs Escalation Recognise scope, impact and uncertainty that require escalation.

✅ Current lesson

Lesson 9 — Another Analyst Has to Read Your Notes Tomorrow Write investigation notes that preserve facts, reasoning and outstanding questions.

Next lesson →

Lesson 10 — From Alert to Closure — Your First SOC Investigation Bring prioritisation, evidence, pivots, decisions and documentation together.

How to write SOC investigation notes

Lesson 9 of the Agent Foskett SOC Analyst Academy teaches analysts how to document confirmed facts, investigative reasoning, negative findings, outstanding questions and next steps for a defensible SOC handover.

SOC analyst shift handover and incident documentation

Learn how to create investigation notes another analyst can reproduce and continue using Microsoft Defender XDR, Microsoft Sentinel and focused KQL evidence.