Do some SOCs have their Tier 2 do an initial passover of an incident?
As the title states:
"Do some SOCs have their Tier 2 Analysts conduct an initial passover of an incident before passing it off to Tier 1?"
Reason why I ask, this has been something being implemented in my organization (we're still immature, only a few years into standing up our SOC).
Posted Nov 28, 2025, 5:46 PM UTC
1712