Escalation: Triage to broader response
Phase 3 · piece 6 of 7
Who needs to know, and with what context?
Escalation is the triage analyst’s most consequential deliverable. The handoff packet is the artifact that determines whether the next tier starts strong or starts from scratch.
What you will get from this chapter
The four pillars
Criteria for escalation
The thresholds that should trigger escalation regardless of who is on shift.
Read →Internal and external protocols
Tier 1 / 2 / 3 responsibilities, plus the external paths (vendor, legal, law-enforcement) when they apply.
Read →Triage vs. incident response
The methodology’s sharpest piece of original thinking. The two are different work; the difference matters.
Read →The handoff packet
The structured deliverable Escalation produces. What it contains and why each piece matters.
Read →Why Escalation is its own phase
The handoff is the artifact
Tap to revealThe triage analyst’s most consequential output is not “we found something.” It is the structured packet that lets the next tier act without re-investigating. The packet is the artifact, not the alert.
Triage and IR are different work
Tap to revealTriage frames the puzzle. IR completes it. Confusing the two leads to either premature escalation (IR doing triage’s job) or delayed escalation (triage trying to do IR’s). Escalation is the phase where the analyst decides which work this is.
Criteria beat judgment under pressure
Tap to revealPre-defined escalation criteria prevent the case where a stressed analyst hesitates on something that should have escalated five minutes ago. Criteria are the SOC’s collective judgment encoded ahead of time.
External paths exist
Tap to revealSometimes the escalation goes to a vendor, to legal, to law enforcement, to a parent company’s SOC, or to the customer. Escalation is the phase that knows which path applies and when.