SOC › Module 8 › Lesson 2
Escalation
Escalation literacy — L1 to L2 criteria, severity gates, handoff minimums — on $SOC_LAB practice scenarios.
Visual · t29_escalation
Escalation = named tier handoff criteria. $SOC_LAB. Original Cyberlium.
Opening
Escalate with evidence, not panic — name L1→L2 criteria on YOUR practice scenarios before you page production on-call without cause.
Escalation literacy names: when L1 escalates to L2 (confirmed TP beyond playbook, asset criticality high, multi-alert chain, potential data impact category), severity gates (P1/P2 definitions at literacy level), handoff minimums (alert IDs, enrichment done, ticket link, UTC timeline stub), and what NOT to escalate (FP-Benign without documentation, incomplete enrichment, personal hunch only). Analyst maps $SOC_LAB practice scenarios to escalate/hold/close — without unauthorized prod pages, without hiding TP to avoid escalation, without escalating to impress. Cyberlium teaches tier boundaries aligned Module 9 handoff. Refused: prod on-call page without authorization, escalation without ticket, skipping L2 context. Lab row: three scenarios with escalate yes/no and reason each.
1. Escalation criteria
Confirmed TP, critical asset, chained alerts, data impact category — four literacy triggers.
Hold when enrichment incomplete — finish Module 6-3 first.
Command guide
Try these commands — Escalation criteria
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Escalation criteria — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final MITRE critical techniques — https://attack.mitre.org/ FIRST CSIRT — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
cat > "$SOC_LAB/tickets/escalation-template.md" <<'EOF'
# Escalation Template (YOUR lab playbook)
## Escalate to L2 when:
- Confirmed TP on critical/high alert (e.g. ALR-002 external admin brute)
- C2/malware proxy block + auth anomaly correlation
- Multiple users affected from same src_ip
## Escalate to IR/Management when:
- Suspected data exfil or ransomware keywords in YOUR alerts
- Executive account compromise indicators
## Include in escalation:
- Alert ID, timeline, jq/grep evidence from YOUR logs
- FP/TP rationale, MITRE mapping, recommended containment
Lab only — never escalate based on unauthorized SIEM dumps
EOFCommand — copy this
grep -E 'Escalate|L2|Lab only' "$SOC_LAB/tickets/escalation-template.md"
Primary tools to practice this lesson: grep, python3. Reference sites: Escalation criteria (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); MITRE critical techniques (https://attack.mitre.org/); FIRST CSIRT (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Handoff minimums
Ticket link, alert IDs, enrichment summary, UTC timeline — L2 expects these rows.
Escalation is not blame transfer — document your triage work.
3. Refused
No unauthorized prod pages; no escalation without ticket context.
Escalation literacy supports tier hygiene — not on-call harassment.
4. What you ship: escalation decision table
Three scenarios + escalate yes/no + reason + handoff minimum checklist.
5. What you record before the next lesson
Escalation decision table path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Page employer prod on-call at 3am from lab scenario without authorization.
Right
Escalation decision table from $SOC_LAB practice scenarios. Next: SLA Hygiene.
Mission: escalation decision table
1) List four escalation triggers. 2) Handoff minimum checklist. 3) Three scenario decisions with reasons. 4) Write NEVER unauthorized prod page line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Hold vs escalate — enrichment incomplete?”
Knowledge Check
APPLY: Escalation literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Paging prod on-call without authorization is lab.
True or False
Knowledge Check
APPLY: L2 handoff minimum includes:
Multiple choice