CSA (312-39) SOC Simulation Lab

Analyze real-world SOC escalation workflows. You will learn the exact order of operations when passing a confirmed threat from the SOC triage desk to a dedicated Incident Response Team (IRT).

Scenario Context

You are observing the workflow of Emmanuel, a Tier 2 SOC Analyst at Tobey Tech, a mid-sized financial services firm. The company recently matured its security operations by spinning up a dedicated, specialized Incident Response Team (IRT) to handle complex containment and forensics.

Emmanuel has been analyzing an alert regarding impossible travel and lateral movement. After verifying the severity, he officially transitions the incident out of the SOC's purview and assigns the ticket to the IRT's queue.

Security Environment

Here is the current state of the ServiceNow SecOps queue as the ticket lands on the IRT Commander's desk:

[ServiceNow Ticket: INC-99042] | Queue: INCIDENT_RESPONSE | State: NEW
Reporter: E. Gonzalez (SOC L2)
Short Description: Confirmed Lateral Movement via Compromised VPN (J.Smith)
SOC Notes:
- Detected anomalous RDP from VPN IP 192.168.50.12 to internal DC-01.
- User J.Smith badge swipe logged in Chicago at 08:15 AM.
- VPN login from Kiev, UA at 08:45 AM (Impossible Travel).
- Verified MFA fatigue attack succeeded.
- Action taken: Suspended AD account. Escalating to IRT for DC-01 memory forensics and network containment.
Assigned to: UNASSIGNED

The ticket is waiting in the IR queue. The IRT takes ownership of it. What must they do first to ensure standard operating procedure?

Question

Emmanuel is working as a SOC analyst in a company named Tobey Tech. The manager of Tobey Tech recently recruited an Incident Response Team (IRT) for his company. In the process of collaboration with the IRT, Emmanuel just escalated an incident to the IRT.

What is the first step that the IRT will do to the incident escalated by Emmanuel?
SOC Hint: Think about the state of the ticket. Emmanuel already generated the record in the ticketing system. When the IR Commander opens the ticket, what do they need to determine before they can assign a severity (priority) or start digging into the logs?

Expert Insight

What is happening?

The SOC acts as the frontline radar. Emmanuel detected the anomaly, investigated enough to confirm it wasn't a false positive (validation), and escalated it via a ticketing system (recording). The ticket has now crossed the boundary from the SOC to the dedicated Incident Response Team. The IRT is now taking initial custody of the escalated event.

Why Option C is Correct

Incident Classification is the correct first step for the IRT upon receiving an escalated ticket. Before the IRT can effectively respond, they must classify the nature of the incident (e.g., Malware, Insider Threat, Data Exfiltration, Denial of Service). Classification dictates which specific IR playbook to pull off the shelf, which determines the subsequent actions.

Why the Others are Wrong

  • B. Incident Recording: This has already occurred. The SOC analyst (Emmanuel) recorded the incident when creating the ticket/alert that was escalated to the IRT.
  • D. Incident Prioritization: You cannot accurately prioritize an incident until you classify what it is. A Ransomware classification will naturally dictate a higher prioritization than an Adware classification. Priority follows Classification.
  • A. Incident Analysis and Validation: The IRT will indeed perform deep-dive analysis, but only after the incident is classified and prioritized. Doing deep analysis before triage leads to disorganized response efforts.

Real-World SOC Application

In modern SOAR platforms (like Cortex XSOAR or Splunk SOAR), this step is often heavily automated. However, when an IR Commander manually reviews an escalated Jira ticket, their first action is literally clicking a dropdown labeled "Incident Type" or "Category" (Classification). If they tag it "Identity Compromise," the platform automatically maps the MITRE ATT&CK tactics, updates the SLA timers (Prioritization), and assigns the Identity Forensics SME to begin deep investigation (Analysis).

MINI LESSON: The Triage Pipeline

In mature security organizations, the incident handling pipeline follows a strict, logical progression to prevent chaos during a crisis:

  1. Detection/Recording: The SIEM fires an alert, generating a ticket.
  2. Initial Validation (SOC): Analyst confirms it's not a false positive.
  3. Escalation: Handoff to IRT.
  4. Classification (IRT First Step): "What kind of incident is this?" (e.g., Phishing, DDoS).
  5. Prioritization: "How bad is it?" (e.g., Low, Medium, High, Critical).
  6. Analysis/Containment: "Let's stop the bleeding and investigate."

Mastering this flow is critical for the EC-Council CSA exam and for real-world security operations.

Explore more CSA simulations