◇ OpenCyber Academy
Engineering · Chapter 37 · English

Chapter 37 — Security operations and blue team: operations

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 37 — Security operations and blue team: operations

Lesson map

Lesson 37 published. Map, example, EX109.

flowchart TD
  N0["Learning outcomes"]
  N1["37.1 Shifts and handovers"]
  N2["37.2 Triage"]
  N3["37.3 Escalation"]
  N4["37.4 Workload"]
  N5["37.5 Wellbeing"]
  N6["37.6 Daily feedback"]
  N7["37.7 Engineering in operations"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX109"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["37.1 Shifts and handovers"]
  N2["37.2 Triage"]
  N3["37.3 Escalation"]
  N4["37.4 Workload"]
  N5["37.5 Wellbeing"]
  N6["37.6 Daily feedback"]
  N7["37.7 Engineering in operations"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX109"]

[Learning outcomes]
    |
    v
[37.1 Shifts and handovers]
    |
    v
[37.2 Triage]
    |
    v
[37.3 Escalation]
    |
    v
[37.4 Workload]
    |
    v
[37.5 Wellbeing]
    |
    v
[37.6 Daily feedback]
    |
    v
[37.7 Engineering in operations]
    |
    v
[Worked example] --> [Exercise EX109]

Learning outcomes

You will (1) run day-to-day SOC operations: shifts, handovers and queues; (2) apply triage and escalation procedures; (3) manage analyst workload and wellbeing; (4) improve operations from daily feedback.

37.1 Shifts and handovers

Lindqvist's SOC runs day and night shifts. Handovers use a template: open cases, alerts awaiting action, system health issues and expected events (such as planned maintenance). Chapter 29's slowest case happened at handover; overlapping shifts by 15 minutes now gives time to talk.

Written handovers stop knowledge from leaving with the outgoing analyst. Expected events, such as maintenance windows, prevent the incoming shift from treating planned outages as attacks. Fifteen minutes of overlap allows a conversation about anything the template does not capture, such as an analyst's unease about an alert that has not yet produced firm evidence.

37.2 Triage

Analysts follow a triage sequence: confirm the alert is valid, gather context from enrichment, decide benign, suspicious or malicious, and either close with reason or escalate. Sundaramurthy et al. (2014) observed that much of this knowledge is tacit; written triage notes per rule make it shareable.

Confirming validity first avoids investigating alerts caused by broken parsing or test events. Context from enrichment answers who, what and where quickly. Closing with a reason, rather than simply closing, gives data for tuning and lets reviewers check decisions. Written notes per rule capture what experienced analysts know but rarely write down.

37.3 Escalation

Escalation paths name who to call for each alert type, with times. Analysts never hesitate to escalate; false escalations are reviewed without blame.

Hesitation is dangerous: an analyst who waits to be sure may lose the time needed to contain an attack. The review asks what information would have helped decide, which often leads to better enrichment or clearer playbooks. Contact lists are checked weekly. When a named person does not answer within the stated time, the path lists who comes next, so analysts never wait on a single phone.

37.4 Workload

Alert fatigue lowers accuracy (Alahmadi et al., 2022). Queue limits, rotation between alert types and protected time for investigation reduce fatigue.

Fatigue builds when analysts handle similar alerts for hours, making mistakes more likely. Queue limits stop a single analyst being buried; rotation varies the work; protected time lets analysts finish deep investigations without constant interruption. Managers track queue sizes per analyst, not just in total. Amara checks whether her rules add to the heaviest queues. When they do, she looks first at enrichment or tuning that could make each alert faster to handle.

37.5 Wellbeing

Night work and incidents are stressful. Managers watch for burnout signs and share incident load.

Signs of burnout include withdrawal, irritability, rising errors and frequent sickness. Sharing incident load means the same person is not on every major incident. Managers offer debriefs after distressing cases and make sure night workers get proper rest between shifts. Healthy staff make better decisions. Lindqvist offers confidential counselling to SOC staff, and managers mention it openly so that using it carries no stigma. Rotas are planned at least four weeks ahead.

37.6 Daily feedback

Each morning, the team spends ten minutes on yesterday's noisy rules and confusing alerts; engineers take actions.

Ten minutes each morning keeps small problems from growing. Analysts mention the alerts that wasted time or were hard to understand; engineers note actions, such as adding a field or adjusting a threshold. Tracking actions to completion shows analysts that their feedback has effect, which keeps them giving it. Actions appear on a shared board, each marked with an owner and a due date, and finished items are announced at the next meeting.

37.7 Engineering in operations

Amara spends one day a week in the queue, so she sees the effect of her rules on analysts first-hand.

Seeing alerts from the analyst's chair reveals problems that are invisible from the engineering side: missing context, confusing titles or rules that fire at the worst moments. Amara rewrites two alert titles after her first day in the queue. The practice also builds trust between engineers and analysts. She logs what she sees each week and brings the most common complaints to the morning feedback meeting.

Closing well

A closed alert records the reason in a sentence a colleague could check later.

Worked example

During her queue day, Amara triages an address-change alert where the confirmation email failed. Enrichment shows the login came from a new network but the device fingerprint matched the customer's usual phone. She escalates rather than closes, noting the mixed signals; the customer confirms they changed mobile provider. She suggests adding device continuity to enrichment.

Synthetic case. Shifts and the alert are invented.

Errors and limits

Procedures cannot cover every alert; analysts' judgement and escalation remain essential.

Exercises

Synthesis

Smooth operations depend on clear handovers, shared triage knowledge, managed workload and engineers who see the queue.

Continue studying — chapter 37 of 50

← Chapter 36 (draft) · Course chapter index · Chapter 38 (draft) →