Escalation chapter quiz

Pre-defined criteria exist precisely to remove this judgment call under pressure. One confirmed criterion escalates the case from whatever phase the investigation is in: that is the escalation tripwire, and the packet finishes in parallel. A confirmed criterion is not overridable by the triage analyst. If the analyst disagrees, the disagreement goes into the packet with its evidence, and only the receiving owner can hand the case back or de-escalate it, with a named reason.

Review: Close or escalate: the escalation tripwire

The distinction is about the question being asked. Triage asks 'is this real, and does it need more than triage?' IR asks 'how do we stop it?' Different outputs follow: a closure record or a handoff packet from triage; containment, eradication, and recovery from IR. Conflating them leads to premature escalation or stalled investigations.

Review: Event triage vs. incident response: two different jobs

The packet is the bridge between triage and IR. The metric is continuity: whether the next tier can act without asking the triage analyst to re-explain. That takes complete sections and a short opening (the five-minute read); optimizing for brevity or completeness alone fails.

Review: The handoff packet: what makes a packet actionable

Completeness is structural; actionability is functional, and a complete packet can still fail it. The case summary plus Risk verdict should orient the receiving tier in under five minutes. The packet should tee up the specific decision the next tier must make ('isolate the second host', 'engage compliance'), not just describe the case. And an analyst with no prior context should be able to continue the work without the author in the room. The practical check for that last test: hand the packet to an uninvolved peer, and if they cannot state the verdict in one sentence after five minutes, it is not done. On a P1, the receiving responder is the cold reader: page first, and treat their first questions as the test results.

Review: The handoff packet: what makes a packet actionable

Tier 1 receives and validates alerts, closes false positives with detection feedback, and works the case through the ASSURED phases until either a closure is defensible or an escalation criterion is confirmed; meeting a criterion moves the case up, but that is escalation, not declaration. Tier 2 picks up escalated cases for deeper investigation and containment planning and, in this model, holds the decision on whether the case becomes a declared incident (real organizations vary: an IR lead, incident manager, or SOC manager may own it). Tier 3 is the senior technical bench for the cases Tier 2 cannot close; the cross-functional response (incident command, legal, communications, executives) is a separate function that activates once an incident is declared, not a tier. The bar for 'escalate' and the bar for 'declared incident' are different, and keeping them separate is what the tier boundaries encode.

Review: Escalation protocols: internal tiers

The page fell through: at 15 minutes with no acknowledgment, a P1 goes to the secondary on-call, then the SOC manager. Meanwhile the pre-authorized immediate actions exist for exactly this window: preserve the records containment would destroy, then disable the account, revoke its sessions, and disable any consented app's sign-in, all reversible and logged. A password reset and grant removal cannot be undone, so they wait for IR or owner approval; segmenting a network or rotating credentials fleet-wide is containment strategy, and that is IR's call. Waiting does nothing while a confirmed attacker holds a live session.

Review: Escalation protocols: paging and acknowledgment

ASSURED treats them as distinct concepts with distinct operational meaning. Events are raw observability data. Alerts cross a threshold and become SOC work. An incident, in NIST SP 800-61r3 (2025), adopting the FISMA 2014 definition, is an occurrence that actually or imminently jeopardizes, without lawful authority, the confidentiality, integrity, or availability of information or an information system, or that violates or imminently threatens to violate law, security policies, security procedures, or acceptable use policies; it is typically confirmed out of one or more alerts and requires coordinated response. Conflating them loses precision under pressure.

Review: Event triage vs. incident response: event, alert, incident

Asset value alone is never a confirmed criterion, so this is not the escalation tripwire and not P1 on asset profile. But unknown is not Low: likelihood reads Medium because the evidence is missing, not because it leans benign. High impact with Medium likelihood is the High/Medium cell: P2, acknowledged within 15 minutes and escalated within 4 hours with a complete packet (default clocks; adopters tune them). P3 would apply only if the evidence had been examined and leaned benign, and then on the high-impact clock, not the standard 24 hours. Closing as unverifiable mistakes a telemetry gap for a verdict; the missing log is itself a finding for the packet.

Review: Close or escalate: high impact and business-critical systems

Escalation still runs; the decision is a documented close instead of a transfer. The worked example runs a five-item closure check (no escalation criterion confirmed or open as a suspicion; the P3 re-score trigger clean; no persistence or credential access; extension, MCP, workspace-task and agent-command review clean; gaps bounded with reopen triggers written), each backed by Uncover findings or the re-score. Notifications are quiet and targeted: the SOC manager for visibility and close approval, detection engineering with the alert-enrichment request and pattern-entry proposal, nobody else, because loud notices for a documented benign close train the team to discount future ones. The closure record is the decision header the event report opens with. The close is arguably the harder discipline, since the analyst is asking a future reader to trust the absence of compromise.

Review: Close or escalate: the closure check

The Communication record is the ninth section of the handoff packet for exactly this reason, so the page goes in. But a backfilled entry is marked as a late entry: the true event time, plus the time it was recorded. Silent backfill makes the record look contemporaneous when it is not, which undermines audit integrity the moment someone compares it with the paging system's own log. Verbal handoffs and post-close amendments both lose information.

Review: Talking to people during triage: the communication record

When a case touches the mail tenant, the chat workspace, or the identity provider that signs users into them, those channels are closed for the case: the adversary may be reading them, and a page or a question sent there lets the attacker watch the response. Chat signs in through the same identity provider, so it is no safer than mail. Page IR by pager and phone bridge, and call the user on a number taken from HR records or a contact list kept outside the affected systems, as it stood before the incident window. Holding every contact is wrong too: the page goes out at once on a trusted channel, and the user's answer can still change the decision before a criterion is confirmed. In Case C, the 09:19 phone call to rvega is what took the case to High confidence.

Review: Talking to people during triage: out-of-band communication