Agent Foskett Academy • SOC Analyst Academy • Module 10 • Lesson 99 • Complete SOC Investigation Scenarios

Lesson 99 — The Night Shift Needs a Complete Handover

Your shift ends in twelve minutes.

The incident does not.

Another analyst is taking over.

Can they continue without starting again?

A good handover transfers the investigation — not just the ticket.

Build the Handover Back to SOC Analyst Academy

Agent Foskett preparing a SOC incident handover for the night shift

The investigation must survive the shift change.

Transfer evidence, scope, containment, uncertainty and next actions.

✓ Status

✓ Evidence

✓ Actions

✓ Next Steps

Case briefing

17:48 SHIFT ENDS: 18:00 CONFIRMED: Compromised identity WS-214 compromised Cloud downloads CONTAINED: Sessions revoked WS-214 isolated UNANSWERED: WS-331 compromised? Did data leave? Another session active? THE INCIDENT IS NOT FINISHED. YOUR SHIFT IS.

Investigation objective

Produce a handover that lets the incoming analyst understand the incident state, trust the evidence, recognise remaining risk and continue immediately.

Investigator's rule

If the next analyst has to reconstruct your thinking, the handover is incomplete.

Stage 1 — state the current assessment

CURRENT ASSESSMENT A compromised identity was used for suspicious cloud access and activity on WS-214. WS-214 is confirmed compromised and isolated. Related activity on WS-331 remains under investigation. Cloud downloads occurred. External exfiltration is not yet confirmed.

Lead with the current truth

The incoming analyst should not need to read twenty updates before learning what the team currently believes happened.

Separate confirmed from suspected

Use explicit language such as confirmed, suspected, unknown and not confirmed so assumptions do not become facts during shift change.

Stage 2 — preserve the timeline

Time	Event	Status
14:51	Unfamiliar successful sign-in	Confirmed
15:04	Sensitive cloud files accessed	Confirmed
15:07	Bulk downloads	Confirmed
15:22	Suspicious process on WS-214	Confirmed
15:41	Related activity on WS-331	Investigating
16:03	Sessions revoked	Completed
16:09	WS-214 isolated	Completed

Time order reduces confusion

A concise timeline shows attack progression and response actions without forcing the next analyst to rebuild chronology from scattered notes.

Include defensive actions

Containment changes the environment. Record what was done and when so later telemetry can be interpreted correctly.

Stage 3 — transfer the evidence

Evidence	Finding
Entra sign-in telemetry	Unfamiliar successful session
Cloud activity	Sensitive files accessed and downloaded
Endpoint telemetry	Suspicious activity confirmed on WS-214
Device correlation	WS-331 has related but incomplete evidence
Containment record	Sessions revoked and WS-214 isolated

Point to evidence, not memory

Record useful queries, incidents, alerts and entities so the incoming analyst can verify important findings.

Do not paste everything

A handover is not a telemetry dump. Summarise the evidence that supports decisions and point to deeper detail where needed.

Stage 4 — record containment precisely

COMPLETED ✓ Sessions revoked ✓ Credential reset initiated ✓ WS-214 isolated ✓ Malicious inbox rule removed NOT COMPLETED ○ WS-331 not isolated ○ Data exposure unresolved ○ Related identities still scoped ○ Recovery not started DO NOT WRITE: "CONTAINED" IF ONLY PART OF THE INCIDENT IS CONTAINED.

Partial containment matters

Specify exactly which identity, device, session or access path has been controlled. A vague “contained” status can create dangerous confidence.

Record pending actions too

If isolation, credential reset or another response action failed or remains pending, the next analyst needs to know immediately.

Stage 5 — define current scope

Entity	Status	Reason
alex@contoso.com	Confirmed compromised	Suspicious session and cloud activity
WS-214	Confirmed compromised	Malicious process activity
WS-331	Suspected	Related remote activity needs validation
Finance SharePoint	Affected resource	Sensitive files downloaded
Other identities	Unknown	Scoping incomplete

Scope needs status

Distinguish confirmed compromise, suspected compromise, affected resources and entities that still require investigation.

Unknown is valid

Do not turn missing evidence into reassurance. Label unresolved scope as unknown and explain how it should be tested.

Stage 6 — hand over the unanswered questions

OPEN QUESTIONS 1. Was WS-331 compromised? 2. Did downloaded cloud data reach an external destination? 3. Were other identities used from suspicious infrastructure? 4. Did activity continue after session revocation? 5. Is recovery safe to begin? THESE BECOME THE NEXT ANALYST'S STARTING POINT.

Questions preserve momentum

A strong handover tells the next analyst exactly what remains unresolved instead of making them discover the gaps again.

Prioritise active risk

Put possible active attacker access and containment gaps ahead of lower-priority historical questions.

Stage 7 — provide the next actions

NEXT SHIFT PRIORITY 1 Validate WS-331 PRIORITY 2 Check post-containment authentication and cloud activity PRIORITY 3 Scope other identities PRIORITY 4 Resolve cloud data exposure PRIORITY 5 Update incident lead before recovery begins

Make actions executable

“Continue investigating” is not useful. Tell the analyst what to check, why it matters and what decision the result should support.

Priorities prevent drift

The incoming analyst should know which unresolved risk deserves attention first.

Stage 8 — give them a useful pivot

1234567891011

let Device = "WS-331";
DeviceProcessEvents
| where Timestamp > ago(8h)
| where DeviceName =~ Device
| project Timestamp,
          AccountName,
          InitiatingProcessFileName,
          FileName,
          ProcessCommandLine
| order by Timestamp asc

Give them a starting point

Include the query or entity pivot producing useful evidence so the incoming analyst can continue quickly.

Do not freeze the theory

The next analyst should understand your reasoning but remain free to change direction if new evidence contradicts it.

Stage 9 — the complete handover

INCIDENT HANDOVER ASSESSMENT Identity compromise with cloud and endpoint activity. CONFIRMED alex@contoso.com WS-214 Sensitive cloud downloads SUSPECTED WS-331 CONTAINMENT Sessions revoked WS-214 isolated Inbox rule removed UNKNOWN External data destination Other affected identities WS-331 compromise status NEXT Validate WS-331 Check post-containment activity Scope related identities Resolve data exposure Update incident lead

Write for someone who was not there

The handover must make sense to an analyst who did not hear the conversations, see your screen or follow the investigation during your shift.

Defensible means traceable

Important conclusions should connect to evidence, important actions should have a status, and important unknowns should have a next step.

Decision point

A "Still investigating. See ticket." B Paste every query result C Transfer assessment, timeline, evidence, scope, containment, unknowns and next actions D Wait until the incident is finished BEST DECISION: C TRANSFER THE INVESTIGATION. NOT JUST THE TICKET.

Handover is incident response

Poor shift transition can lose evidence, duplicate work and delay containment. A good handover keeps the investigation moving.

One lesson remains

Lesson 100 brings the entire Academy together: triage, investigate, scope, contain, document and close a multi-stage incident from beginning to end.

Lesson 99 key takeaways

Start with the current incident assessment.
Separate confirmed, suspected and unknown findings.
Preserve a concise chronological timeline.
Include containment actions and their exact status.
Transfer evidence supporting important conclusions.
Do not bury the next analyst in raw telemetry.
Define current scope by identity, device and affected resource.
Record unresolved questions explicitly.
Prioritise active-risk questions first.
Give the next analyst specific, executable actions.
Include useful query or entity pivots.
A good handover transfers the investigation, not just the ticket.

Module 10 — Complete SOC Investigation Scenarios

Lesson 99 ensured an unfinished investigation could survive a shift change without losing evidence, reasoning or momentum. One lesson remains: the complete final SOC investigation.

Next: Lesson 100 — Your Final SOC Investigation

Continue your SOC Analyst training

Module 9 focuses on turning validated investigation findings into transparent, tested and operationally useful detections.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 10: Complete SOC Investigation Scenarios

Apply the full SOC workflow across realistic multi-stage incidents, from triage and investigation through containment, handover and closure.

← Previous lesson

Lesson 98 — The Insider-Threat Hypothesis Was Wrong Change direction when evidence disagrees with the theory.

✅ Current lesson

Lesson 99 — The Night Shift Needs a Complete Handover Produce a defensible handover for an unfinished incident.

Next lesson →

Lesson 100 — Your Final SOC Investigation Triage, investigate, scope, contain, document and close a multi-stage incident.

How should a SOC analyst write an incident handover?

Lesson 99 of the Agent Foskett SOC Analyst Academy teaches analysts to transfer an unfinished security incident between shifts using a clear assessment, timeline, evidence, containment status, scope, unanswered questions and next actions.

Writing a defensible SOC shift handover

Learn how to distinguish confirmed, suspected and unknown findings, document partial containment, preserve investigative reasoning and give the incoming analyst an actionable starting point.