Escalation

Not all alerts can or should be resolved at the first tier of analysis. When an L1 analyst encounters an alert that requires deeper expertise, additional authority, or broader context, they escalate it to an L2 or L3 analyst. Escalation paths define how and when incidents move between tiers, and poorly managed escalation, such as too many unnecessary escalations or unclear criteria, is a significant source of inefficiency in SOC operations.