Agent Foskett Academy • SOC Analyst Academy • Module 7 • Lesson 61 • Incident Response: Containment, Evidence & Escalation

Lesson 61 — The Investigation Became an Incident

It started with one alert.

One suspicious sign-in.
One account.
One analyst.

Then another account appeared.
A device showed suspicious activity.
An OAuth application entered the timeline.
Sensitive SharePoint data was accessed.

The analyst was still investigating.

Agent Foskett looked at the evidence and asked a different question:

“Are we still analysing an alert — or are we now running an incident?”

The transition to incident response happens when the evidence requires coordinated action, not simply because an alert looks serious.

Recognise the Transition Back to SOC Analyst Academy

Agent Foskett recognising when a SOC investigation becomes an incident

Analysis has become response

Recognise when scope, active threat, impact and containment needs require coordinated incident handling.

✓ Identify response triggers

✓ Establish incident ownership

✓ Preserve evidence

✓ Escalate with purpose

Case briefing

07:46 — Suspicious sign-in alert 07:52 — Account activity reviewed 08:01 — Unusual cloud application activity 08:09 — Second account appears 08:17 — Endpoint evidence discovered 08:24 — Sensitive SharePoint files accessed 08:31 — External sharing activity 08:36 — New suspicious session observed WHAT STARTED AS: ONE ALERT ONE ACCOUNT ONE ANALYST HAS BECOME: MULTIPLE IDENTITIES MULTIPLE WORKLOADS ACTIVE RISK POTENTIAL DATA EXPOSURE CONTAINMENT DECISIONS THIS IS NO LONGER JUST AN ALERT INVESTIGATION.

Investigation objective

Recognise when the evidence has crossed the threshold from individual alert analysis into coordinated incident response, then establish ownership, priorities, communication and immediate response needs.

Investigator's rule

An incident is not created by a dramatic alert title. It is created by evidence showing that risk, scope, impact or required action now needs coordinated response.

Stage 1 — understand the transition

ALERT ANALYSIS What triggered? Is it true positive? What entity is involved? What happened? ↓ EVIDENCE EXPANDS ↓ INCIDENT RESPONSE What is affected? Is the threat still active? What must be contained? What evidence must be preserved? Who needs to act? Who owns the response? What is the business impact? THE QUESTIONS HAVE CHANGED. THAT MATTERS.

The transition is operational

The analyst may continue investigating, but the work now requires more than analysis. Containment, evidence preservation, coordination, communication and decision ownership have entered the case.

Do not wait for perfect certainty

Incident response often begins while important questions remain unanswered. Waiting until every hypothesis is resolved can allow an active threat to continue.

Stage 2 — recognise the response triggers

Trigger	Why it matters
Multiple affected entities	The scope may exceed one alert, account or device.
Active malicious activity	Delay may increase damage.
Persistence	The actor may retain access after simple remediation.
Privilege	Administrative access can materially increase risk.
Sensitive data	Potential exposure may require business and compliance involvement.
Cross-service activity	Multiple technical owners may need coordinated action.
Containment required	Actions may disrupt users, devices or services and need authority.
Business impact	Operational decisions may exceed the SOC analyst's remit.

Severity alone is not the threshold

A high-severity alert can still be a contained false positive. A collection of lower-severity observations can become a major incident when correlated evidence shows active compromise and growing impact.

Scope changes the response

One suspicious event may be manageable by one analyst. Multiple identities, endpoints, applications or workloads often require coordinated ownership and parallel investigation.

Stage 3 — build the incident evidence timeline

1234567891011

CloudAppEvents
| where Timestamp > ago(1d)
| where AccountId in~ ("alex@contoso.com", "casey@contoso.com")
| project Timestamp,
          AccountId,
          Application,
          ActionType,
          IPAddress,
          UserAgent,
          RawEventData
| order by Timestamp asc

Keep the evidence moving

Escalation does not mean investigation stops. Continue building the timeline while response ownership, containment and additional technical work are coordinated.

Use the timeline as shared truth

As more teams join, a timestamped evidence record prevents everyone from building a different version of the incident from memory or chat messages.

Stage 4 — ask whether the threat is active

ACTIVE THREAT QUESTIONS Are suspicious sessions still active? Are commands still executing? Is the account still authenticating? Is the application still accessing data? Are files still being downloaded? Is external sharing continuing? Are new entities appearing? Is persistence still present? Is the actor moving laterally? IF YES: THE RESPONSE CLOCK IS ALREADY RUNNING.

Active activity changes priority

An investigation into historical suspicious behaviour is different from observing an actor still operating in the environment. Continuing malicious activity increases the urgency of containment decisions.

State what is active

Avoid vague statements such as “the attack is ongoing.” Record the specific evidence: a session is still active, new file access continues, another device has appeared, or an application is still making requests.

Stage 5 — identify immediate containment decisions

Entity	Possible response question
User account	Should sessions be revoked or the account disabled?
Endpoint	Should the device be isolated?
OAuth application	Should consent or permissions be removed?
Mailbox	Should forwarding, rules or delegated access be remediated?
SharePoint / OneDrive	Should external access or sharing links be removed?
Infrastructure	Should indicators be blocked according to approved controls?

Containment has consequences

Disabling an executive account, isolating a production server or removing a business-critical application can create significant impact. The need for containment must be balanced with urgency, evidence and organisational authority.

Containment is not improvisation

Use approved incident procedures, escalation paths and delegated authority. The SOC should know which actions analysts can perform directly and which require incident leadership or business approval.

Stage 6 — preserve evidence before changing the environment

BEFORE REMEDIATION, CONSIDER PRESERVING: Alert / incident identifiers Timeline timestamps Identity and sign-in context Session information Device evidence Process / file evidence Application identifiers OAuth permissions / consent Mailbox configuration evidence SharePoint / OneDrive activity External sharing details Affected resources IP addresses / user agents Analyst queries and findings WHY? CONTAINMENT CAN CHANGE OR REMOVE THE STATE YOU ARE INVESTIGATING.

Evidence preservation is part of response

Do not treat preservation as paperwork to perform later. Remediation can revoke sessions, remove grants, delete rules or change endpoint state. Capture required evidence according to organisational procedures before it disappears.

But do not preserve evidence forever while damage continues

Evidence value must be balanced against active risk. If malicious activity is causing ongoing harm, approved emergency containment may take priority over collecting every possible artefact.

Stage 7 — establish incident ownership

ALERT OWNER: Investigates the original detection INCIDENT OWNER / LEAD: Coordinates the overall response IDENTITY: Authentication / sessions / account actions ENDPOINT: Device investigation / isolation MESSAGING: Mailbox / phishing / transport activity CLOUD: Applications / SharePoint / data access BUSINESS: Operational impact / priorities LEGAL / PRIVACY / COMPLIANCE: When organisational procedures require them ONE INCIDENT. CLEAR OWNERSHIP. COORDINATED ACTION.

Someone must own the whole picture

Technical teams can own individual workstreams, but one incident owner or defined response process should maintain overall priorities, status, decisions and dependencies.

Parallel work needs coordination

Identity may revoke sessions while endpoint isolates a device and messaging removes malicious rules. Without coordination, one team's action can alter another team's evidence or interrupt an agreed response sequence.

Stage 8 — escalate with evidence, not panic

WEAK ESCALATION: "URGENT!!! WE HAVE BEEN HACKED!" STRONG ESCALATION: "Two user identities and one endpoint are currently linked by correlated suspicious activity. Sensitive SharePoint data was accessed and external sharing occurred. A suspicious session remains active. Containment decisions are required for the affected accounts, endpoint and application permissions. Current evidence timeline attached. Initial scope is still expanding."

Tell responders what you need

A useful escalation identifies confirmed facts, current risk, affected entities, actions already taken, evidence gaps and the decision or authority required next.

Do not exaggerate certainty

“Potential data exposure” and “confirmed external access” are different statements. Keep escalation language aligned with the evidence available at that moment.

Stage 9 — record the transition point

08:17 — Endpoint evidence discovered 08:24 — Sensitive data access confirmed 08:31 — External sharing observed 08:36 — Suspicious session remains active 08:39 — INCIDENT RESPONSE INITIATED REASON: Correlated evidence now spans two identities, one endpoint and multiple cloud workloads. Active suspicious activity remains present. Potential sensitive-data exposure requires containment and coordinated response. INCIDENT OWNER: Assigned according to organisational procedure. NEXT PRIORITIES: 1. Preserve critical evidence 2. Contain active access 3. Confirm affected scope 4. Coordinate technical workstreams 5. Assess business / data impact

The transition itself is evidence

Record when the case moved into incident response and why. Later reviewers should be able to understand what evidence justified escalation at that point in time.

Decisions need timestamps too

Record not only malicious events but important response decisions: when containment was approved, when sessions were revoked, when a device was isolated and when stakeholders were notified.

Stage 10 — keep analysis and response connected

INVESTIGATION ↓ NEW EVIDENCE ↓ SCOPE UPDATE ↓ RESPONSE DECISION ↓ CONTAINMENT ACTION ↓ NEW TELEMETRY ↓ REASSESSMENT ↓ NEXT DECISION INCIDENT RESPONSE IS NOT A SINGLE BUTTON. IT IS A CONTROLLED DECISION LOOP.

Containment can reveal new evidence

After a session is revoked or device isolated, continued activity may indicate another session, another device, an application permission or an additional persistence mechanism.

Reassess continuously

Incident status, severity, scope and containment priorities can change as new evidence appears. The original assessment should not become permanent simply because it was written first.

Decision point — is this now an incident?

Observation	Assessment
Second identity linked to activity	Scope expanding
Endpoint evidence correlated	Cross-domain compromise possible
Sensitive SharePoint access	Business/data impact possible
External sharing observed	Potential exposure requires action
Suspicious session still active	Threat may be ongoing
Multiple containment decisions required	Coordinated response needed

Decision: The evidence now supports transition from individual alert analysis to coordinated incident response.

Example incident escalation note

INCIDENT STATUS: Active — coordinated response initiated CURRENT SCOPE: 2 user identities 1 endpoint 1 cloud application Exchange and SharePoint activity CONFIRMED: Correlated suspicious activity spans identity, endpoint and cloud workloads. Sensitive SharePoint resources were accessed. External sharing activity occurred. CURRENT RISK: A suspicious session remains active. Scope may continue to expand. ACTIONS REQUIRED: Preserve critical evidence. Evaluate identity containment. Evaluate endpoint isolation. Review application permissions. Assess external data exposure. Continue tenant-wide scoping. CONFIDENCE: Evidence supports one correlated incident. Full initial-access mechanism remains under investigation.

Lesson 61 key takeaways

An alert investigation becomes an incident when the evidence requires coordinated response.
Severity alone does not determine whether incident response is needed.
Expanding scope, active threat, persistence, privilege, data exposure and business impact are important response triggers.
Do not wait for perfect attribution before responding to credible active risk.
Continue investigation while incident response is coordinated.
Use a shared evidence timeline to keep multiple responders aligned.
Containment decisions should consider urgency, evidence, business impact and authority.
Preserve required evidence before remediation changes the environment when circumstances allow.
Assign clear incident ownership even when technical work is distributed across teams.
Escalate using confirmed facts, current risk, scope and explicit decisions required.
Record when and why incident response was initiated.
Incident response is a continuous loop of evidence, decisions, actions and reassessment.

Module 7 — Incident Response: Containment, Evidence & Escalation

Lesson 61 recognised the moment analysis became coordinated response. Lesson 62 tackles one of the SOC's most important containment decisions: whether to isolate a device now or continue collecting evidence.

Next: Lesson 62 — Do We Isolate the Device Now?

Continue your SOC Analyst training

Module 3 focuses on identity incidents, authentication, MFA, privilege, sessions and application access.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 7: Incident Response: Containment, Evidence & Escalation

Move from investigation into coordinated response by making evidence-based containment, preservation and escalation decisions.

← Previous lesson

Lesson 60 — Building the Complete Cloud Compromise Timeline Create a defensible cross-service timeline.

✅ Current lesson

Lesson 61 — The Investigation Became an Incident Recognise the transition from analysis to coordinated response.

Next lesson

Lesson 62 — Do We Isolate the Device Now? Balance containment urgency against business impact and uncertainty.

When does a SOC investigation become an incident?

Lesson 61 of the Agent Foskett SOC Analyst Academy teaches security analysts how to recognise when alert analysis should transition into coordinated incident response based on expanding scope, active malicious activity, persistence, privilege, sensitive data exposure and business impact.

Incident response escalation, containment and evidence preservation

Learn how to establish incident ownership, preserve evidence, communicate current risk, coordinate identity, endpoint and cloud responders, and document the decision to initiate incident response.