Lesson 69 — Writing the Incident Handover
The incident had been running for hours.
Two devices had been isolated.
An identity had been contained.
Cloud access had been reviewed.
The current scope was finally stabilising.
Then the shift changed.
The incoming analyst opened the incident record and found:
“Investigated. Looks contained. Keep monitoring.”
Agent Foskett stared at the note.
“Excellent. Now all we need is the other six hours of the investigation.”
Transfer the investigation, not just the ticket.
Preserve current status, scope, evidence, actions, decisions, risks, unknowns and the exact next steps.
Case briefing
Investigation objective
Create a concise, evidence-based incident handover that transfers the operational picture and gives the next analyst enough context to act safely and efficiently.
Investigator's rule
If the next analyst has to rediscover your reasoning, you handed over the ticket — not the investigation.
Stage 1 — start with the current state
Lead with what matters now
The incoming analyst should not have to read six hours of chronology before learning whether the attacker is active, containment is incomplete or a critical decision is waiting.
Use precise status language
Prefer “FIN-WS-044 isolated at 16:42 and isolation verified” over “device handled.” Prefer “no renewed suspicious cloud activity observed since 16:50” over “cloud looks okay.”
Stage 2 — preserve the minimum useful timeline
| Time | Event | Why it matters |
|---|---|---|
| 14:02 | Suspicious PowerShell on FIN-WS-044 | First confirmed malicious endpoint activity. |
| 14:21 | Related activity appears on FIN-WS-061 | Incident scope expands. |
| 14:25 | Suspicious cloud file access | Confirms cross-control-plane activity. |
| 15:10 | Identity containment begins | Attacker access starts being reduced. |
| 15:18 | Both affected endpoints isolated | Endpoint containment milestone. |
| 16:50 | No renewed known malicious activity observed | Supports containment conclusion. |
Do not dump every event
The incident record may contain the full timeline. The handover should highlight the events needed to understand current scope, decisions, containment and remaining work.
Preserve source references
Where your incident system supports it, reference the relevant alert, query, evidence item, case record or artefact so the next analyst can verify important claims without repeating the entire search.
Stage 3 — state the confirmed scope
Separate confirmed from suspected
The incoming analyst must know which entities are proven affected and which remain hypotheses. Mixing them can cause unnecessary containment or missed investigation.
Include cleared branches when useful
A short note explaining that FIN-WS-073 was reviewed and cleared can stop the next analyst from wasting time reopening a completed pivot.
Stage 4 — transfer the evidence that drives decisions
DeviceProcessEvents
| where Timestamp between (datetime(2026-09-03 14:00:00) ..
datetime(2026-09-03 16:00:00))
| where DeviceName in~ ("FIN-WS-044", "FIN-WS-061")
| project Timestamp, DeviceName, AccountName,
FileName, ProcessCommandLine
| order by Timestamp ascGive the next analyst reproducible pivots
If a query materially supports the incident conclusion, preserve the query or search criteria according to your tooling and procedures. Do not rely on “I checked Defender and it looked bad.”
But the handover is not a query library
Include or reference only the evidence needed to understand the current state and continue the response. The complete investigation record can hold the deeper technical detail.
Stage 5 — record actions and their results
| Action | Owner | Result |
|---|---|---|
| Isolate FIN-WS-044 | Endpoint team | Completed and verified. |
| Isolate FIN-WS-061 | Endpoint team | Completed and verified. |
| Contain affected identity | Identity team | Known malicious access paths addressed. |
| Remove mailbox persistence | Messaging team | Completed; related mailbox scope reviewed. |
| Address malicious application access | Cloud team | Completed; verification recorded. |
| Review alex@contoso.com | SOC | Still in progress. |
Actions need outcomes
“Identity team notified” tells the next analyst almost nothing. Record whether the action occurred, what changed and whether the expected result was verified.
Record timestamps where they affect interpretation
The next analyst may need to distinguish attacker activity before containment from activity that occurred after controls should have taken effect.
Stage 6 — transfer decisions and reasoning
Decisions are part of the evidence trail
Record major containment, preservation, escalation and recovery decisions with enough rationale that the incoming analyst understands why the incident is in its current state.
Do not hide disagreement
If a material decision remains disputed or requires approval, state that clearly. The next shift should not discover an unresolved authority issue by accident.
Stage 7 — make unknowns impossible to miss
Unknowns are operational work
“Still investigating” is not enough. State what remains unknown, why it matters and what the next analyst should do to resolve it.
Prioritise the open questions
Some unknowns affect immediate containment; others affect later root-cause or impact analysis. Make that distinction explicit so the next analyst works the right problem first.
Stage 8 — state residual risk
The next analyst needs trigger conditions
Explain what evidence would change the incident state, require escalation or reopen active containment. This turns passive monitoring into an actionable plan.
Risk should be current, not historical
The incident may have started as critical and now be contained with limited residual risk. Or the opposite may be true. Describe the risk at handover time.
Stage 9 — write the next three actions
Priorities prevent restart
A handover that says “continue investigation” forces the incoming analyst to decide where to restart. Give them ordered, decision-focused actions.
Assign owners
Do not assume another team knows it owns an action. Where the process allows, record the responsible workstream or person and confirm significant handoffs are acknowledged.
Stage 10 — use a repeatable handover structure
Write for the next decision
The handover does not need to reproduce every investigative detail. It must preserve enough context that the next analyst can make the next decision without rebuilding the case.
Use the organisation's system of record
Follow your incident-management process for where handover information, evidence references and decisions must be recorded. A chat message alone should not become the permanent incident record.
Example final handover
Lesson 69 key takeaways
- A handover transfers the investigation, not merely the ticket.
- Lead with the current incident state and immediate risk.
- Preserve a concise timeline of decision-relevant events.
- Separate confirmed, suspected, investigating and cleared scope.
- Reference material evidence and reproducible pivots.
- Record actions together with their verified outcomes.
- Preserve major decisions and the reasoning behind them.
- Make open questions visible and actionable.
- State current residual risk and re-escalation triggers.
- Give the next analyst ordered actions with clear owners.
- Use a repeatable handover structure.
- The next analyst should be able to continue without rebuilding the incident from scratch.
Module 7 — Incident Response: Containment, Evidence & Escalation
Lesson 69 transferred a live incident safely between analysts and workstreams. Lesson 70 brings the entire module together: detection, investigation, evidence preservation, containment, coordination, recovery and the final response decisions.
Continue your SOC Analyst training
🔎 SOC Analyst Academy — Module 7: Incident Response: Containment, Evidence & Escalation
How do you write a SOC incident handover?
Lesson 69 of the Agent Foskett SOC Analyst Academy teaches analysts how to transfer incident status, scope, evidence, response actions, decisions, residual risk and unanswered questions between analysts or teams.
Cyber security incident handover checklist
Learn how to build a concise incident handover that preserves the investigation timeline, confirmed scope, containment results, open questions, next actions and re-escalation triggers so the next analyst can continue without rebuilding the case.
