<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-soc-shift-handoff
description: >-
  Structured shift handoff procedures for SOC teams including active incident
  state transfer, queue status summaries, pending escalation tracking,
  environmental context sharing, and handoff verification checklists across
  Splunk ES, Elastic Security, and Microsoft Sentinel.
domain: cybersecurity
subdomain: soc-operations
tags:
  - shift-handoff
  - soc
  - operations
  - continuity
  - incident-management
  - siem
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing SOC Shift Handoff

## Overview

Shift handoff is the critical transition point where outgoing SOC analysts
transfer situational awareness, active investigations, and queue state to the
incoming shift. Poor handoffs cause dropped incidents, duplicated work, and
delayed response. This skill covers structured handoff procedures that ensure
continuity across 24/7 SOC operations.

## Prerequisites

| Requirement | Purpose |
|---|---|
| SIEM access (Splunk ES/Elastic/Sentinel) | Queue and incident state |
| Ticketing system (ServiceNow/Jira) | Open ticket tracking |
| Communication platform (Slack/Teams) | Handoff channel |
| Shift roster / scheduling tool | Shift assignment verification |

## Key Concepts

### Handoff State Categories

```
HANDOFF STATE TRANSFER:
├── Active Incidents — Currently being investigated
│   Include: status, last action taken, next steps, SLA countdown
├── Pending Escalations — Awaiting T2/T3 or management response
│   Include: who was contacted, when, expected response time
├── Queue Status — Unassigned alerts snapshot
│   Include: count by severity, oldest alert age, trending rules
├── Environmental Context — Network/system changes
│   Include: maintenance windows, known outages, new deployments
└── Intelligence Briefing — Active threats and campaigns
    Include: new IOCs, active threat campaigns, ISAC bulletins
```

### Splunk ES Shift Summary Queries

```spl
-- Open incidents by owner and severity (shift snapshot)
| from datamodel:"Notable"
| where status!="closed"
| stats count by owner, urgency, status
| sort owner, urgency

-- Alert volume trend over last 8 hours (outgoing shift)
index=notable
| where _time > relative_time(now(), "-8h")
| timechart span=1h count by urgency

-- Pending escalations awaiting action
| from datamodel:"Notable"
| where status="pending" AND urgency IN ("critical","high")
| eval age_min=round((now()-_time)/60,0)
| table time, rule_name, owner, urgency, age_min, comment
| sort -urgency, -age_min
```

### Elastic Security Shift Summary

```
// Open alerts by assignee for shift transition
kibana.alert.workflow_status:"open" OR
kibana.alert.workflow_status:"acknowledged"
| stats count by kibana.alert.assignee, kibana.alert.severity

// Alert volume over outgoing shift
kibana.alert.start >= "now-8h"
| date_histogram interval=1h field=kibana.alert.start
```

### Sentinel KQL Shift Summary

```kql
// Incident handoff summary
SecurityIncident
| where Status in ("New", "Active")
| project Title, Severity, Status, Owner,
    Age=datetime_diff("minute", now(), CreatedTime)
| sort by Severity asc, Age desc

// Alert volume during outgoing shift
SecurityAlert
| where TimeGenerated > ago(8h)
| summarize AlertCount=count() by bin(TimeGenerated, 1h), AlertSeverity
| render timechart
```

### Handoff Checklist Template

```
OUTGOING ANALYST: ____________  INCOMING ANALYST: ____________
SHIFT: ____________  DATE: ____________

□ ACTIVE INCIDENTS
  Incident ID | Status | Last Action | Next Step | SLA
  ___________|________|_____________|___________|____

□ PENDING ESCALATIONS
  Ticket | Escalated To | When | Expected Response
  _______|______________|______|___________________

□ QUEUE SNAPSHOT
  Critical: __ | High: __ | Medium: __ | Low: __
  Oldest unassigned: __ minutes

□ ENVIRONMENTAL CONTEXT
  Active maintenance windows: _______________
  Known outages: _______________
  Recent deployments: _______________

□ INTELLIGENCE UPDATES
  New IOCs ingested: _______________
  Active campaigns: _______________

□ TOOLING STATUS
  SIEM: ☐ Healthy  EDR: ☐ Healthy  SOAR: ☐ Healthy
  Known issues: _______________

OUTGOING SIGN-OFF: ____________  TIME: ____________
INCOMING ACK:      ____________  TIME: ____________
```

## Workflow

1. **Prepare** — Outgoing analyst compiles shift state 30 min before end
2. **Summarize** — Generate queue snapshots and incident summaries from SIEM
3. **Document** — Fill handoff template with all active items
4. **Brief** — Live verbal handoff covering critical items first
5. **Transfer** — Reassign tickets and alert ownership in SIEM
6. **Verify** — Incoming analyst confirms access and understanding
7. **Archive** — Store handoff record in SOC knowledge base

## Verification

| Check | Method |
|---|---|
| All active incidents transferred | Ticket ownership matches incoming shift |
| Queue state communicated | Incoming analyst can state queue depth |
| Escalations tracked | Pending items have documented timelines |
| Environmental context shared | Incoming aware of maintenance windows |
| Handoff record archived | Template stored in SOC knowledge base |
