Escalation

Escalation literacy — L1 to L2 criteria, severity gates, handoff minimums — on $SOC_LAB practice scenarios.

Escalation• Audio Walkthrough

00:00/03:01

Visual · t29_escalation

Escalation = named tier handoff criteria. $SOC_LAB. Original Cyberlium.

Escalate with evidence, not panic — name L1→L2 criteria on YOUR practice scenarios before you page production on-call without cause.

Escalation literacy names: when L1 escalates to L2 (confirmed TP beyond playbook, asset criticality high, multi-alert chain, potential data impact category), severity gates (P1/P2 definitions at literacy level), handoff minimums (alert IDs, enrichment done, ticket link, UTC timeline stub), and what NOT to escalate (FP-Benign without documentation, incomplete enrichment, personal hunch only). Analyst maps $SOC_LAB practice scenarios to escalate/hold/close — without unauthorized prod pages, without hiding TP to avoid escalation, without escalating to impress. Cyberlium teaches tier boundaries aligned Module 9 handoff. Refused: prod on-call page without authorization, escalation without ticket, skipping L2 context. Lab row: three scenarios with escalate yes/no and reason each.

1. Escalation criteria

Confirmed TP, critical asset, chained alerts, data impact category — four literacy triggers.

Hold when enrichment incomplete — finish Module 6-3 first.

Command guide

Try these commands — Escalation criteria

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Escalation criteria — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE critical techniques — https://attack.mitre.org/ FIRST CSIRT — https://www.first.org/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/tickets/escalation-template.md" <<'EOF'
# Escalation Template (YOUR lab playbook)
## Escalate to L2 when:
- Confirmed TP on critical/high alert (e.g. ALR-002 external admin brute)
- C2/malware proxy block + auth anomaly correlation
- Multiple users affected from same src_ip
## Escalate to IR/Management when:
- Suspected data exfil or ransomware keywords in YOUR alerts
- Executive account compromise indicators
## Include in escalation:
- Alert ID, timeline, jq/grep evidence from YOUR logs
- FP/TP rationale, MITRE mapping, recommended containment
Lab only — never escalate based on unauthorized SIEM dumps
EOF

Command — copy this

grep -E 'Escalate|L2|Lab only' "$SOC_LAB/tickets/escalation-template.md"

Primary tools to practice this lesson: grep, python3. Reference sites: Escalation criteria (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE critical techniques (https://attack.mitre.org/); FIRST CSIRT (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Handoff minimums

Ticket link, alert IDs, enrichment summary, UTC timeline — L2 expects these rows.

Escalation is not blame transfer — document your triage work.

3. Refused

No unauthorized prod pages; no escalation without ticket context.

Escalation literacy supports tier hygiene — not on-call harassment.

4. What you ship: escalation decision table

Three scenarios + escalate yes/no + reason + handoff minimum checklist.

5. What you record before the next lesson

Escalation decision table path.

6. Wrong vs right: stranger SIEM vs YOUR sample logs

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Page employer prod on-call at 3am from lab scenario without authorization.
Right: Escalation decision table from $SOC_LAB practice scenarios. Next: SLA Hygiene.

Hands-on Exercise