The handoff packet
What the packet contains
🏷️ Case metadata
The header above the nine sections: case ID, author, handoff time (UTC), who owns the next action, the escalation criterion that fired with a one-line rationale, and material AI use. The packet identifies itself before it explains itself.
📌 1. Case summary
One paragraph. What happened, what is known, what the triage analyst recommends.
⏰ 2. Timeline
Sequential events with timestamps. Includes both adversary actions and analyst actions (when notified, what was checked, when escalated).
👥 3. Entities
Primary and secondary entities with their assessment results. The Subject and Scope output.
🔍 4. Evidence chain
The Uncover narrative with sources, queries used, and MITRE ATT&CK A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations, used for threat modeling and security operations. technique mappings.
⚖️ 5. Risk verdict
Impact, likelihood, combined priority, and recommended response.
📦 6. Containment actions taken
What Containment The incident-response phase between detection and eradication: isolate the affected hosts, revoke the compromised credentials, block the C2 destinations, freeze the situation so it stops getting worse while the investigation continues. was already done (host isolated, account disabled, etc.) and what was deliberately not done and why.
📎 7. Artifacts
Relevant log excerpts, Indicators of Compromise (IoC) Atomic, replayable artifacts that, when observed, suggest an intrusion has occurred or is in progress: file hashes, IPs, domains, registry keys, certificate fingerprints, and similar discrete observables. Behavioral patterns (process trees, sequence of actions) are not IoCs; they live one layer up as TTPs. , hashes, screenshots, queries. Attached or linked so the next analyst does not have to re-derive them. Each artifact carries its custody and preservation state: where the original lives, its identifying hash, and who has handled it, per the chain-of-custody procedure. If the case ends up in front of a regulator or a court, this field is what keeps the evidence usable.
🚧 8. Open questions
What the triage analyst could not resolve and would have pursued next. The IR team picks up from this list.
📞 9. Communication record
Who has been notified so far, on which channel, when. Manager paged at 14:02. Compliance flagged at 14:18. Vendor request opened at 14:35. Prevents duplicate notifications, gives IR an instant view of who already knows, and starts the audit trail for regulatory reporting.
The packet is documentation
The handoff packet is also the documentation record. Months later, this packet is what an auditor or a post-incident reviewer will read. Writing it for clarity (not just brevity) pays off the moment someone needs to understand the case without the analyst present.
What makes a packet actionable
A complete packet still fails if it does not pass a few practical tests. The methodology asks the analyst to verify three properties before declaring a packet ready for handoff.
📖 Can be read in five minutes
The case summary plus the Risk verdict should give the receiving tier the picture in under five minutes. Detail lives in the appendix. The opening should orient, not exhaust.
🎯 Names the next decision
A good packet does not just describe the case; it tees up the decision the next tier needs to make. “Isolate the second host,” “engage compliance,” “contain the federated session”: concrete recommendations.
🪞 Survives the cold read
An analyst who was not involved should be able to open the packet, understand the case, and continue the work. If the packet requires the triage analyst’s presence to interpret, it is not actionable yet.
A packet that fails the cold-read test
A common anti-pattern: the packet reads as a sequence of analyst thoughts (“I checked X, looked OK, then I checked Y, found something weird”). The narrative makes sense to the person who wrote it. Someone reading it cold has no idea what was concluded.
The fix is structural. Replace the analyst-narrative voice with the nine-section format above. Each section answers a specific question; the reader can navigate them without reading the others. The case summary at the top tells the reader whether they need to read the rest at all.
Test the packet by handing it to a peer who has no context on the case. If they cannot summarize the verdict in one sentence after five minutes, the packet is not done.
Key Takeaway
The handoff packet is the triage analyst’s deliverable. Nine named sections, each one a documented answer to a question the next tier would otherwise have to ask. Three practical tests: readable in five minutes, names the next decision, survives the cold read.