What gets lost between shifts
Most of what goes wrong in a SOC handover is not dramatic. A half-finished investigation is noted as “looking into it”. An approval asked for at 4am is never chased. A noisy rule the night shift learned to ignore is not mentioned, so the day shift spends an hour on it again. A good handover is a short written record, built during the shift, that lets the next person pick up the work without having to ask the last person anything.
Spoken handovers feel efficient and lose detail. The outgoing analyst is tired and summarises; the incoming analyst is fresh and assumes the summary is complete. Neither notices what was left out until it matters. Writing it down does not do away with the conversation, but it gives the conversation something to check against.
The gap is widest where shifts change at odd hours, where a team covers several time zones, or where the night is worked by a provider and the day by an in-house team. Each of those adds a second handover inside the first one, and each is a place where detail can drop out.
These are the things that most often fall through the gap:
- The state of an investigation: what was checked, what was ruled out, what is still unknown.
- Promises made to other teams, such as “we will let you know by nine”.
- Decisions waiting for someone’s approval, and who was asked.
- Context learned on shift: the change window that explains a burst of alerts, the server being rebuilt.
- Tool problems: a log source that went quiet, a connector that failed, a search that times out.
A handover template
Keep the template short and fixed. If it takes more than ten minutes to fill in at the end of a shift, people will skip it on the busy nights, which are the nights it matters. The better habit is to fill it in as the shift goes, so the end of the shift is a review rather than a writing task.
Every open item needs an owner after the handover. “Day shift” is not an owner. A name, or a role that one person holds at a time, is.
End the written handover with a short spoken one, five minutes face to face or on a call, where the incoming analyst reads the list back and asks questions. The reading back catches most of the gaps. If the incoming analyst cannot say what the next step is on each open item, the handover is not finished.
- Shift, date, analysts on duty and who led.
- Open investigations: one line each with the alert or case reference, current status, what was checked, the next step and who owns it now.
- Pending approvals: what action was proposed, who was asked, when, and what happens if no one answers.
- Escalations made: to whom, when, and whether they acknowledged.
- Things learned: changes, maintenance windows, known noise, context from IT.
- Platform health: log sources that stopped, failed integrations, rules that misbehaved.
- Anything the next shift must do at a fixed time.
Handing over an open investigation
The hardest thing to hand over is an investigation in the middle. Write the status as three short lists: what you know, what you ruled out, and what you have not checked yet. The ruled-out list is the one people skip and the one that saves the most time, because without it the next analyst re-runs the same searches to reach the same place.
An illustrative example. An alert fires for a new local administrator account on a file server at 03:10. The night analyst confirms the account was created by an IT engineer’s account, finds no logons with the new account, and asks IT whether the change was planned. No reply yet. The handover line reads: “File server FS02, new local admin ‘svc_backup2’ created 03:10 by an IT admin account. Ruled out: logons with the new account (none), other new accounts on the host (none). Unknown: whether the change was planned. Asked IT on-call 03:40 by ticket, no answer. Next: chase IT at 08:30; if not planned, escalate as suspicious.”
That line takes a minute to write. Without it, the day shift either repeats the night’s work or, worse, sees a quiet alert with no activity on it and closes it.
Decisions waiting for approval
Approvals are where handovers fail most dangerously. A night analyst proposes isolating a laptop and asks the incident lead. The lead does not answer before the shift ends. The day analyst does not know the request exists. The laptop stays on the network for hours longer than anyone intended, and nobody decided that it should.
Track approvals as their own list, separate from investigations, with the time asked and a fallback. The fallback is decided in advance: if the lead does not answer in thirty minutes, the request goes to the deputy. The incoming shift reads this list first, before anything else.
Keep the outcome too. “Approved by incident lead 05:12 by phone” or “Declined, business owner wants it left running until 09:00 with monitoring”. Those lines are what an auditor, or your own review, asks for later, and they protect the people who made the call.
Tools for a written record
The tool matters less than the habit, but a few properties matter. The record should be in one place, searchable, timestamped automatically and linked to the alerts and cases it talks about. A shared chat channel is fine for talking and poor as the record: messages scroll away and threads split.
Whatever you choose, avoid two places holding the same thing. Handover notes in a document and status in tickets will disagree within a week, and then nobody trusts either.
- A ticketing system such as Jira or ServiceNow suits open investigations and approvals, because each item has an owner and a status.
- A handover page or form per shift, linked to the tickets, gives the summary view.
- Chat tools such as Slack or Microsoft Teams are good for the conversation and for notifications, with key decisions copied into the record.
- Case notes in the investigation tool itself keep the evidence next to the reasoning.
The morning review
A short daily review, fifteen minutes at the start of the day shift, closes the loop. Walk through the handover: each open investigation, each pending approval, each escalation. The lead decides what carries on, what closes and what needs a call to someone outside the SOC.
Use it to look at the night as well as the work. Which alerts took longest? Which were noise that could be tuned? Did anyone have to make a call they did not feel authorised to make? Those answers feed the runbooks, the tuning list and the escalation paths.
Rotate who runs it. An analyst who runs the review a few times writes much better handovers afterwards, because they have been on the reading end.
Where armor360 fits
armor360 keeps a written record of each investigation by design: the questions the agent asked, the records it collected, the verdict with its confidence, and what a person decided when reviewing it. The Today page opens on what is waiting for a person, which gives the incoming shift a starting point.
It can send findings to Slack, Microsoft Teams, PagerDuty, email, Jira or ServiceNow, and keeps an audit trail of who approved what and when. Campaign plans wait for a person’s approval at each step; armor360 takes no response actions itself.
