The one-page reference
The whole methodology on one card: what each phase asks, what it must produce, and the decision that exits it. Print it with your browser’s print dialog (Ctrl+P or Cmd+P); the print stylesheet turns it into a desk card. The introduction teaches it; this page only reminds you of it.
Memory hooks: the two S’s are who before where. E is the decision, not the outcome; most verdicts close. A confirmed escalation criterion exits from any phase (the break-glass rule).
The seven phases
Produce: the validated alert (detection mechanism and its trust level, normalized fields, validation results) plus flagged leads and temporal anchors.
Decide: known-benign pattern with library discriminators → Level 0 five-field close · no real signal → close as false-positive with detection feedback · validated signal → Subject.
Produce: the entity map (primary, secondary, downstream), per-entity assessment on the four dimensions, baselines with confidence labels, insider indicators (or “none observed”).
Decide: all four dimensions clean and the alert explained → close with evidence · any dimension dirty or unexplained → Scope · insider pattern → engage HR/legal channel, do not tip the subject.
Produce: the one-page scope: regulatory flags and their clocks, the time window, entity boundaries, and the visibility map (what the tooling cannot see, named).
Decide: regulated data in reach → start the parallel clocks and engage the owners · boundaries set → Uncover · new evidence later widens the lines → re-scope; the loop is the method working.
Produce: the confidence-labeled timeline, the hypothesis ledger with recorded negatives, and the ATT&CK mapping of the reconstructed chain.
Decide: evidence supports a benign explanation → Risk with a close recommendation · malicious chain reconstructed → Risk · criterion confirmed mid-phase → escalate now, finish the phases under IR’s clock.
Produce: the impact × likelihood verdict scored on the RATM rubric, the priority from the triage matrix (P1 to P4), and a named confidence level.
Decide: P1 → escalate immediately, warm handoff · P2 → escalate within the shift · P3 → keep working, re-score within 24 hours on a named trigger · P4 → document and close.
Produce: the close-or-escalate decision against the pre-committed criteria, and (on escalate) the nine-section handoff packet that survives the five-minute cold read.
Decide: criterion met → escalate through the protocol tier the criterion names · no criterion met → documented close, a first-class verdict · either way, the reasoning goes in the record.
Produce: the event report (nine sections), the sanitized share version, links to every related artifact, and the detection-engineering brief.
Decide: record passes closure review → case closed · reviewer requests clarification → fix the record, not the memory of it · exemplary either way → training archive.
The escalation checklist
Run at every phase. Any criterion confirmed escalates immediately (break-glass, P1); suspicion refines Scope instead. The full checklist with sub-checks is a template: ⬇ escalation-checklist.md.
The depth ladder
Any surprise moves the case up a level, never down mid-case. Depth and urgency are separate decisions: break-glass escalates even from inside a Level 0 check. Full rules: the fast path.