Chapter 2 of 13 · Day 1
Who to call at 3am and what escalate means
- Who do I call if something bad happens at night?
- What does "escalate" actually mean here?
- Will I get in trouble for waking someone up?
On a night shift you will sometimes be the only person awake who is looking at security alerts. That feels heavy until you know one thing: you are never expected to handle a serious incident alone. You are expected to notice it and get the right people involved fast.
What escalate really means
To escalate is to hand a decision to someone who has more context, more access or more authority than you. It is not an admission that you failed. It is the system working. A SOC that never escalates is not calm, it is blind.
There are usually two kinds of escalation, and it helps to keep them apart:
- Technical escalation. You need a more experienced analyst to look, or someone with access you do not have, such as the owner of a cloud account.
- Severity escalation. The thing in front of you might be an incident, and someone who can declare one needs to know. That person can wake up other people. You usually cannot.
Find these out today
- Who is on call tonight for the SOC, and how you reach them: phone, pager, chat.
- What severity levels your team uses and what each one triggers.
- Which alert types must be escalated no matter what, for example a known ransomware behaviour or an admin account doing something new.
- Who to call if the on-call person does not answer within the time in the runbook.
- Where to write down that you escalated, and when.
The question you might not ask out loud
Will I get in trouble for waking someone up over nothing?
In a healthy team, no. Ask your lead directly in your first week: "If I am unsure at 3am, do you want the call?" Almost every lead says yes. Then you have permission in writing, and the fear goes away.
How to make the call
Keep it short and in the same order every time: what you saw, when, on which system or account, what you checked, and what you think it might be. Then say what you need: "I need someone to decide whether to isolate this host." A clear ask gets a fast answer, even from someone half asleep.
Rule of thumb:Rule of thumb: if you are asking yourself whether to escalate for more than ten minutes, escalate. The cost of a short call is small. The cost of a quiet night that was not quiet is not.