SOC › Module 9 › Lesson 2
Handoff L2
L1 to L2 handoff literacy — summary block, open items, severity, contact — on $SOC_LAB practice escalations.
Visual · t29_handoff_l2
Handoff L2 = named tier transfer package. $SOC_LAB. Original Cyberlium.
Opening
A bad handoff wastes two tiers — pack the summary L2 needs from YOUR practice escalation, not a vague 'please investigate.'
L1 to L2 handoff literacy: executive summary (three lines max), severity and ticket link, alert IDs and rule names, enrichment completed vs pending, timeline UTC stub from Module 9-1, recommended next steps category (contain, enrich, close), and analyst contact. Analyst builds handoff block from Module 8 escalate-yes ticket on $SOC_LAB — without escalating real prod without RoE, without omitting open questions, without handing off FP without documentation. Cyberlium teaches professional tier transfer on practice rows. Refused: prod escalation without authorization, handoff with attack repro steps, blaming L1/L2 in narrative. Lab row: complete handoff block template with eight required fields.
1. Handoff block fields
Summary, severity, ticket, alerts, enrichment status, timeline, next steps, contact — eight fields.
Handoff extends Module 8-2 minimums — same evidence chain.
Command guide
Try these commands — Handoff block fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Shift handoff — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/ Splunk handoff — https://docs.splunk.com/Documentation/ES
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/handoff/shift-handoff-template.md" <<'EOF'
# Shift Handoff — SOC L1 (YOUR lab)
## Date/shift: _______
## Open incidents
- INC-LAB-002: external admin brute — escalated to L2
## Closed this shift
- ALR-001: FP (jsmith typo)
- ALR-004: info (scheduled task)
## Monitoring notes
- Watch for repeat 203.0.113.50 activity in YOUR auth.jsonl
- bob phishing block — verify no repeat proxy blocks
## Queue status
- alerts.json: all triaged
## Follow-up for next analyst
- Confirm L2 acknowledged INC-LAB-002
EOFCommand — copy this
grep -E 'Open|Closed|Follow-up' "$SOC_LAB/handoff/shift-handoff-template.md"
Primary tools to practice this lesson: grep, python3. Reference sites: Shift handoff (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/); Splunk handoff (https://docs.splunk.com/Documentation/ES). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender hygiene
Pending enrichment listed honestly — L2 picks up with eyes open.
No attack cookbooks in next steps — defender actions only.
3. Refused
No unauthorized prod escalation; no vague handoff without ticket link.
Handoff literacy supports tier ops — not on-call chaos.
4. What you ship: L2 handoff block template
Eight required fields + one completed practice escalation + NEVER vague handoff line.
5. What you record before the next lesson
L2 handoff block template path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Escalate to real employer L2 with empty notes as 'handoff practice.'
Right
L2 handoff block from $SOC_LAB practice escalation. Next: Shift Hygiene.
Mission: L2 handoff block template
1) List eight handoff fields. 2) Complete block for one practice ticket. 3) List pending enrichment honestly. 4) Write NEVER unauthorized prod escalation line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Executive summary — three line literacy?”
Knowledge Check
APPLY: L2 handoff includes:
Multiple choice
Knowledge Check
APPLY: True or False: Unauthorized prod L2 escalation is lab.
True or False
Knowledge Check
APPLY: Pending enrichment should:
Multiple choice