Documentation: Making the work durable
On this page
Phase 7 · continuous from Alert, finalized here
What did we decide, and what did we learn?
Documentation is what makes triage work survive its closure. It runs alongside every other phase and finalizes at closure, recording decisions, evidence, and reasoning so future analysts and auditors can understand what was done and why.
Documentation is the phase that makes the methodology’s other six phases worth doing. Without it, closed cases fade with the shift that worked them, and the next analyst starts from zero on similar work. With it, the SOC builds institutional memory and the team’s collective skill compounds over time.
What you will get from this chapter
The three pillars
Standards
Format and structure, clarity and precision, timeliness. The discipline that turns notes into records.
ReadTemplates
Alert reporting, timeline tracking, action logs. Templates make documentation fast and consistent.
ReadPitfalls
Incomplete records, post-hoc rationalization, missing evidence chains. The common ways documentation fails.
ReadDocumentation at a glance
- Question
-
What did we decide, and what did we learn?
- Runs
- Continuously from Alert: every phase transition writes its update into the case record. The phase itself runs after the Escalation decision and finalizes that record.
- Deliverable
- The closing record, reviewed and linked: the five-field pattern-close record at Level 0, the alert report at Level 1, the nine-section event report at Level 2 and for every escalated case.
- Done when
- The decision header is complete on both verdict axes; every open question is resolved or carried into recommendations; indicators carry a disposition; shared versions are sanitized; detection-engineering and tuning requests are filed; the record has passed the closure review.
| Level | At this level, Documentation is |
|---|---|
| Level 0 pattern close | The five-field pattern-close record, written at close and citing the pattern entry by ID and version. That record is the whole documentation burden, and it is not optional. |
| Level 1 standard triage | The alert report, written as you go and finalized at close, with the verdict on both axes and the reasoning behind the close or the escalation. |
| Level 2 full arc | The case record, updated at every phase transition, assembled into the nine-section event report under its decision header. An escalated case maps its handoff packet in and links IR’s outputs rather than restating them. |
Why it is its own phase
- The work survives the analyst. A documented case can be reviewed, learned from, and used to train new analysts long after the original investigator has moved on. An undocumented case dies with the shift it ran in.
- Patterns emerge from records. Three documented cases of the same alert type in the same week can reveal a campaign that no single case would show. Documentation is what makes pattern detection possible at the program level.
- Audits are documentation tests. Regulatory audits do not ask “did you do the work?” They ask “can you show that you did?” Some regimes make the record itself the duty: GDPR Article 33(5) requires every personal-data breach to be documented, reported or not. Without the record, the answer is “trust me.”
- Reasoning is the deliverable. What the analyst decided is half the value; why they decided it is the other half. Future reviewers see not just the verdict but the path to it.
Five downstream uses of documentation
Detection engineering
Documentation reveals detection gaps, false-positive and benign-true-positive trends, and emerging threat indicators. Detailed records of IOCs, missed alerts, and lateral movement patterns inform rule refinement and new detections. Well-documented cases often surface subtle adversary behaviors initially overlooked. The detection-feedback page routes each verdict to its owner.
Analyst training
Real events become sanitized simulations or tabletop exercises. These scenarios build analyst proficiency. Documentation of decision-making, especially in complex or unusual cases, serves as teaching material that develops critical thinking among junior responders.
Process improvement
Records of operational gaps, tooling limitations, and process breakdowns drive systematic improvement. Trends across cases surface friction points that single-case retrospectives would miss. Process inefficiencies become tracked items with owners.
Metrics and executive reporting
Aggregated documentation produces impact summaries, risk trends, and security-posture metrics. The key times each record carries (detected, acknowledged, verdict, escalated or closed, contained, reopened) are what the triage measures are computed from. They demonstrate program effectiveness and support budget and strategic decisions.
Threat intelligence
Comprehensive documentation captures new tactics, techniques, and procedures observed during investigations. These insights enrich intelligence repositories and strengthen proactive threat hunting. When appropriate, sanitized intelligence is shared with industry partners and Information Sharing and Analysis Centers (ISACs), marked with a FIRST Traffic Light Protocol 2.0 label (e.g. TLP:AMBER) so recipients know how far it may travel.
One caution on metrics
Any metric a team is judged on gets gamed. Time to close falls fastest when analysts close early and reopen quietly, so pair every speed metric with a quality check (reopen rate, closure-review pass rate) before trusting the trend.
Two disciplines turn the five uses from possible into routine. The first is the post-incident review (PIR) for every major event: using standardized rubrics, it evaluates documentation completeness, cross-checks alert coverage, and assigns owned actions to close the gaps, so incident records drive improvement instead of becoming artifacts Artifacts Traces that activity leaves on a system: prefetch and Amcache entries, registry keys, shell and browser history, log records, files in temporary folders. Uncover uses them to reconstruct what ran when live telemetry did not capture it. Many are overwritten quickly, so collect the volatile ones first (see Order of Volatility). that age in a case-management system. The second is the closure review (per case for Level 2, P1/P2 and escalated-then-closed records; through the weekly QA sample for Level 0 and 1 closes), run against the closure review checklist, which keeps the records the PIR draws on worth reading.
Two practicalities: where the record lives, and how long it is kept
None of the five uses work if the case is scattered across a SIEM comment, a chat thread, and an analyst’s notes file. The system of record is the case-management system; everything else links into it, and the test is that a reader can reconstruct the case from that one entry point without copy-pasting between tools. Retention is a policy decision with legal floors: regulated cases inherit the retention minimums and legal-hold rules covered on Scope’s regulatory page, and even unregulated triage records should outlive the detection rules they justify, because a tuned rule’s history is unreadable without the cases that tuned it.
Key takeaway
Documentation is what makes everything else durable. Done well, it is invisible. Done badly, it is the first thing that breaks down in a stressful incident.Technical details verified . Product names, defaults and retention change; check your own tenant.