Chapter 29 — Security operations and blue team: operations
Lesson map
Lesson 29 published. Map, example, EX085.
flowchart TD
N0["Learning outcomes"]
N1["29.1 Shifts"]
N2["29.2 Handovers"]
N3["29.3 Escalation"]
N4["29.4 Queues"]
N5["29.5 Learning"]
N6["29.6 Wellbeing"]
N7["29.7 Communication"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX085"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["29.1 Shifts"]
N2["29.2 Handovers"]
N3["29.3 Escalation"]
N4["29.4 Queues"]
N5["29.5 Learning"]
N6["29.6 Wellbeing"]
N7["29.7 Communication"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX085"]
[Learning outcomes]
|
v
[29.1 Shifts]
|
v
[29.2 Handovers]
|
v
[29.3 Escalation]
|
v
[29.4 Queues]
|
v
[29.5 Learning]
|
v
[29.6 Wellbeing]
|
v
[29.7 Communication]
|
v
[Worked example] --> [Exercise EX085]
Learning outcomes
You will (1) run shifts and handovers in a student-staffed SOC; (2) manage queues and escalation; (3) support analyst learning and wellbeing; (4) communicate with the university community.
29.1 Shifts
Riverton's SOC runs staffed hours from 08:00 to 20:00 on weekdays, with on-call engineers outside them. Student analysts work four-hour shifts around classes.
The staffed hours explain the campaign's timeline: it began at 01:50, outside them, and the first analyst arrived at 08:00. Overnight, only the on-call engineer could act, and only if paged. The trial paging for high scores, described in the system models chapter, is meant to narrow that gap without staffing nights. Student shifts are timed around lectures, so cover is thinnest at the start of the day, when overnight activity is first seen.
29.2 Handovers
Each shift ends with a handover note: open alerts, cases in progress, system issues and expected events, such as a planned phishing simulation.
A handover note from the campaign's evening might read: s2047 contained, s3310 under investigation, external forwarding block deployed, campus notice sent, expect more reports overnight. The next shift starts knowing what matters, rather than rediscovering it from the queue. Notes are kept with the case records. A good note is brief enough to read in two minutes and specific enough that nothing important depends on memory. The incoming analyst confirms they have read it before the outgoing one leaves.
29.3 Escalation
Student analysts escalate to the duty engineer for anything involving staff accounts, research systems or personal data exposure. Escalation is encouraged; nobody is criticised for escalating in good faith.
The rule is broad on purpose: student analysts are learning, and a missed escalation costs more than an unnecessary one. In the research server case later in the book, the student who saw the night logins escalated at once because it involved a research system, which brought the duty engineer in early.
29.4 Queues
The queue is ordered by the scoring from Laboratory I. During campaigns, the duty engineer may assign alerts directly.
Direct assignment during campaigns prevents several analysts from working the same report while others are untouched. In the exam-week campaign, the duty engineer assigned one analyst to reports and one to account alerts, which addressed the review's finding that the two queues had been hard to connect. Scores still guide each analyst within their assigned work. After the campaign, the engineer returns the queue to normal ordering, and the assignments are recorded in the shift log for later review.
29.5 Learning
Student analysts follow a training path: shadowing, supervised triage, then independent triage of low-severity alerts.
Each stage has a checklist. Shadowing ends when the student can explain the triage guide; supervised triage ends when a senior analyst agrees with most of their decisions over several shifts. Independent work starts with low-severity alerts and moves to higher ones as confidence grows. Lucas followed this path in his first term. Progress is recorded so the next supervisor knows where each student stands, and students who struggle with a stage repeat it rather than being rushed forward.
29.6 Wellbeing
Studies such as Alahmadi et al. (2022) link alert overload to burnout. Shifts are short; analysts rotate between alert types; exam periods have reduced rosters.
Riverton's four-hour shifts limit continuous alert exposure, and rotating between phishing reports and identity alerts reduces monotony. During exams, the reduced roster shifts more work to staff engineers. These choices accept slightly slower triage in exchange for students who stay alert and remain in the programme. Analysts can also ask to step away from a distressing case, such as one involving harassment, without explaining why.
29.7 Communication
The SOC sends campus notices during campaigns: what the email looks like, what to do if you clicked, and how to report.
Notices are short and practical. During the exam-week campaign, the notice showed the subject line, said what to do if you had clicked, and linked to the report button. It went out within an hour, and reports then rose sharply, which helped the SOC find compromised accounts more quickly. Notices avoid blame and technical terms, and the SOC sends a short follow-up when the campaign is over, so people know the danger has passed.
Shift metrics
Each shift records alerts handled, escalations and time to first look. Patterns over a term show when extra cover is needed, such as Monday mornings after weekend campaigns, and help plan rosters before problems arise rather than after.
Quiet periods
On quiet shifts, analysts review closed alerts for quality.
Worked example
During exam week, a second campaign arrives with only two analysts on shift. The duty engineer pauses low-severity alerts, sends a campus notice within an hour, and asks staff from IT to help with password resets. Reports peak at 140 in two hours; all compromised accounts are contained the same day.
Synthetic case. Rosters and events are invented.
Errors and limits
Student availability varies with term; plan staffing around the academic calendar.
Exercises
- EX085 — Escalation triggers. When must student analysts escalate? Rubric: 3 = staff accounts, research systems, personal data exposure; 2 = two; 1 = one; 0 = none.
- EX086 — Wellbeing measures. Name three measures protecting analyst wellbeing. Rubric: 3 = short shifts, rotation, reduced exam rosters; 2 = two; 1 = one; 0 = none.
- EX087 — Exam-week response. How did the SOC cope with the exam-week campaign? Rubric: 3 = paused low alerts, notice in an hour, IT helped resets, contained same day; 2 = partial; 1 = vague; 0 = none.
Synthesis
SOC operations combine clear shifts, encouraged escalation, learning paths and attention to wellbeing.
Continue studying — chapter 29 of 40
← Chapter 28 (draft) · Course chapter index · Chapter 30 (draft) →