Study guide
15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
TryHackMe Security Analyst Level 1 SAL1
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy
2 SOC Simulator Exam Skills
2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes
3 Network Essentials
3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission
4 Operating System Basics
4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity
5 Cryptography, Cloud, Web and Scripting Basics
5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs
6 Cybersecurity Fundamentals and MITRE ATT&CK
6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques
7 Kill Chain, NIST CSF, and Attack Indicators
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain
8 Social Engineering and Network Attacks
8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns
9 Web Exploitation and Endpoint Attacks
9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd
10 Command and Control, Malware, and LOLBAS
10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS
11 EDR, Firewalls, and WAF
11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation
12 SIEM and SOAR
12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration
13 Threat Intelligence and Vulnerability Scanning
13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning
14 SOC Team, Activities, and Alert Triage
14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts
15 SOC Metrics, Escalation, and Communication
15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
Key Takeaways Explain This Topic AI
An escalation schema answers four questions: when to raise, who receives it, how (ticket plus page or bridge), and what minimum facts travel with the handoff.
P1 after-hours ransomware on a criticality-1 file server pages IR and IT on-call immediately. A Qualys-listed IDS "Nmap" alert in a change window is documented, not paged.
Urgent actions are isolate host, disable account (do not delete), and block IoCs — each with change-control caution on domain controllers, service accounts, and high-prevalence destinations.
Need-to-know rings: SOC/IR get full IoCs; IT gets requested changes; legal gets facts and hold language; corporate communications gets approved talking points, not raw hashes in a company-all mail.
Each SAL1 SOC Simulator scenario is 400 marks with Escalation 150 and Case Reports 100. Escalation marks reward correct routing of true incidents, not volume; TryHackMe's simulator advice says not every alert requires escalation.
Last updated: September 2026
Escalation is how a SOC turns a local finding into an organization-sized response without paging the entire company for every IDS chirp. SAL1 training content covers escalation basics , a common escalation schema/matrix , basic remediation for urgent cases , and how communication is managed between teams . The SOC Simulator then tests the judgment: each simulation is 400 marks , with Classification 150 , Escalation 150 , and Case Reports 100 . This section teaches the live-SOC logic those Escalation and report scores depend on. It does not repeat Analyst VM setup, classification scoring traps, or the case-report form itself — those belong in the SOC Simulator chapter.
Escalation basics
Escalation means handing a case to someone with more authority, more context, or more ability to change the environment than the current owner. It is not "I am unsure, so I will CC the world," and it is not "I will sit on ransomware until my shift ends so MTTA still looks fine."
Names vary by employer. A useful teaching hierarchy:
L1 SOC analyst — first touch, lookups, classification, documented close of noise, playbook containment on endpoints when allowed
L2 / monitoring specialist — deeper investigation, correlation across alerts, detection-tuning tickets
Incident Response (IR) or Cyber Incident Response Team ( CIRT ) — major incidents, forensics, organization-wide containment
IT operations / identity / networking — the people who can actually move a VLAN, disable a service account safely, or restore a file server
L1 typically owns noisy, well-documented, and contained items: a known scanner, a blocked phish with no click, a single lab VM that EDR already quarantined. L1 escalates when (1) impact is high or unknown, (2) containment needs privileges they do not have, (3) the incident spans many hosts or identities, (4) legal, regulatory, or public-relations exposure exists, or (5) the playbook says "stop and call IR" for that family — ransomware, business-email compromise with a wire, suspected insider theft, cloud root-key leak.
Over-escalation trains IR to ignore the pager (every unsigned binary becomes a 02:00 bridge). Under-escalation is how a single-host EDR alert becomes a domain-wide encryption event during handover. The matrix exists to make both failures visible.
The schema behind any matrix is four questions a tired analyst at 02:14 can follow:
- When — which severity, category, or time-without-containment triggers the next rung
- Who — named role (L2, IR on-call, IT ops, identity), not "someone in chat"
- How — ticket comment plus page, bridge, or email, and which channel is the system of record
What — minimum packet: host, user, timestamps, verdict, indicators of compromise ( IoCs ), actions already taken, and the decision you need from them
If any of those four is missing, you do not have a matrix. You have folklore that collapses on nights and weekends.
A practical escalation matrix
Severity Example Ack target Contain target Escalate to Page after hours?
P1 Ransomware encryption, domain-admin abuse, data leaving now 15 min 60 min IR lead and IT on-call immediately Yes
P2 Malware or confirmed credential use on a critical or VIP asset 30 min 4 h L2 / IR if not contained Yes if VIP or critical asset
P3 Suspicious, contained, or low blast radius; needs hunting 4 h Next business day L2 at handover if still open No
P4 Policy noise, known scanner, duplicate of a tuned detection Next business day Tune / document Detection-engineering ticket, not IR No
Read the matrix down the after-hours column . That column is the difference between a professional SOC and a pager nobody respects. P1 and selected P2s wake people. P3 and P4 wait for daylight unless new evidence promotes them.
Worked contrast: 02:00 ransomware versus noisy IDS
Scenario A — 02:00 ransomware. Endpoint detection shows lsass access then rapid file renames on FS-FINANCE-01 . Lookup: asset criticality 1, service "month-end close." This is P1. The L1 analyst does not wait for a prettier second alert. They acknowledge , isolate if the playbook allows L1 isolation on file servers, open a major-incident ticket , and page IR and IT on-call . Legal and corporate communications are notified through IR and leadership , not by L1 drafting a press line at the console. The 02:00 page is correct because delay is the damage.
Scenario B — 02:00 noisy IDS. An IDS fires "possible Nmap" from 10.8.20.14 . Lookup: known-scanner list, Qualys weekly window, change ticket CHG-4412. Verdict: authorized activity or benign true positive . Document the lookup hit, close or auto-close with the scanner reason code, and do not page . If the same signature fires from a new public IP with no change record, it is no longer Scenario B — it becomes at least P3, and P2 after prevalence and asset lookups.
Handover is a third mini-scenario. If Scenario A is still open at 07:00, the outgoing analyst's communication job is to state: pages already sent, isolate status, blocks placed, who owns the bridge. Dumping "lots of ransomware alerts, good luck" is a communication failure even if MTTA on the first alert was 8 minutes.
High-level tie to SAL1 simulator scoring
TryHackMe's exam-scoring article splits each SOC Simulator at 400 marks : 150 Classification , 150 Escalation , 100 Case Reports . Treat Escalation marks as a test of routing , not of how many times you pressed Escalate. Official SOC Simulator exam advice on the TryHackMe Help Center says to treat the scenario like a real SOC: identify threats, escalate when necessary , and keep notes clear — and it states that not all alerts require escalation . Focus on alerts with clear IoCs , check repeat offenders, and correlate. Case-report marks then record why you paged or why you did not: timestamps, IoCs, actions already taken. That is the same "what" packet as the matrix. The report template and classification-zero warnings are taught in chapter 2; here the skill is matching Scenario A to a page and Scenario B to a documented non-page.
Urgent remediation — and the change-control brake
When a case is truly urgent, L1 or L2 often take three families of action. Each has a change-control caution . Containment of a false positive is still an outage. Escalation scoring, in a simulation and in a real SOC, assumes you contained the right thing.
Isolate the host
What: EDR network isolate, switch-port disable, VPN or certificate revoke, or (last resort) taking a workstation off the network.
Why: Cut command-and-control and stop ransomware from reaching the next share.
Caution: Isolating a domain controller , email gateway , hypervisor , or shared production jump host can create a larger outage than the malware. Prefer EDR isolate on endpoints when the tool exists. For servers, IR and IT should be on a bridge before you disable a NIC, unless the playbook already names that host class as "isolate immediately." Record the action and the previous network state so IT can reverse it. Isolation is a change even when it is an emergency change.
Disable the account
What: Disable the directory or cloud user, revoke refresh tokens, reset the password, kill sessions. Disable, do not delete — deletion destroys forensic attribution and mail history.
Caution: Service accounts and shared break-glass identities can halt payroll, backups, or single sign-on for thousands of people. Confirm human versus service with an identity lookup. If it may be a service account, escalate to identity or IT; do not "be a hero" at 02:10. Disabling the CFO's account during an active wire-fraud investigation may be correct; deleting it is not.
Block the IoC
What: Firewall or proxy deny, email-gateway hash or sender block, EDR hash or process block, DNS sinkhole.
Caution: Prevalence first. Blocking an IP that also serves a software-update CDN, a cloud provider NAT, or your own outbound proxy will look like brilliant MTTR and will be a self-inflicted denial of service. Temporary blocks with an expiry, a change record even for emergencies, and a second-person check on global blocks are the professional pattern. The ticket should say what was blocked, where, and when it expires.
None of these three replaces classification. They are what you do after Scenario A is real, and what you refuse to do in Scenario B.
How SOC communication is managed across teams
Think in need-to-know rings , with the ticket as system of record . Chat and phone exist for speed; if the decision is not in the ticket, it did not happen for the next shift, for IR, or for a case report.
- Ring Teams What they need What they should not get by default
- Inner L1/L2 SOC, IR Full IoCs, hostnames, commands, hypothesis, timeline Public-facing wording
Build / repair IT ops, identity, networking, desktop Actions requested, change windows, rollback, affected configuration items Speculative blame, unconfirmed "nation-state" labels
Risk / legal Legal, compliance, privacy Facts, data types possibly exposed, timeline, legal-hold instructions Casual "we were breached" language; unvetted IoCs in personal mail
Outer Corporate communications, HR, executives Confirmed impact, next customer step, approved talking points Raw malware hashes in a company-all email
IR owns the technical investigation once escalated. IT executes infrastructure changes the SOC cannot. Legal decides notification duties, privilege, and holds. Communications owns external and all-staff narrative so forty engineers do not invent one on social media. Junior analysts rarely brief the press. They do decide whether the 02:00 event is Scenario A or Scenario B, and they do paste bridge decisions back into the ticket.
Practical rules that keep communication from becoming a second incident:
- A P1 bridge is appropriate; the ticket still gets the decision, attendees, and actions
- Handover is a communication event: open P1/P2 cases, pages sent, blocks placed, who owns next
- Do not send IoC packs through unmanaged personal channels
If legal says preserve, stop ad-hoc remediation that wipes evidence, and write that constraint in the ticket so IT does not "helpfully" reimage first
Detection-engineering tickets are communication too: Scenario B should produce a tuning request, not a silent pile of ignored signatures
On the simulator, Escalation marks and Case Report marks rise or fall together when the notes match the routing: paged for ransomware with IoCs and isolate time in the record; did not page for the scanner, with the lookup named. That is SOC communication, condensed into a scored workflow.