Feedback loops: how to get better on purpose

A strange thing about triage is that you rarely learn whether you were right. You close an alert, the queue moves on, and nothing tells you if that call was good. Without feedback, you can do the same thing wrong for months with full confidence.

So build the feedback yourself. It does not need to be formal.

Four small loops

1. Reopened tickets. Once a week, search for any of your closed tickets that were reopened or linked to an incident. Read what changed.
2. Peer review. Ask a senior analyst to read three of your tickets a week, picked by them. Ask one question: "What would you have done differently?"
3. Shadowing upward. Sit in on one escalated case per week, even if you only listen. See what the next level checks that you did not.
4. Your own notes. Keep a short list of alert types you got wrong or were unsure about. Revisit it each month. Watch it shrink.

Feedback you can give

Feedback runs both ways. You see the alerts every shift. If a rule fires on nothing all day, tell whoever owns detections, with examples. If a runbook step no longer matches the tools, say so. Many improvements in a SOC start with a tired analyst saying "this alert is always the same backup job".

• Raise a tuning request with two or three example alerts attached.
• Suggest a runbook edit with the exact step and the exact fix.
• Share a useful query in the team channel. Others will improve it.

Practice outside the queue helps too. A lab where you get an immediate answer, right or wrong, trains judgement faster than weeks of unscored alerts.

Rule of thumb:Rule of thumb: if you cannot name one thing you learned from a mistake this month, you are not getting enough feedback. Go and find some.