# SOC Shift Report

Writes a security operations center (SOC) shift handover report from the outgoing analyst's notes. Use it at the end of every shift so the incoming analyst has full situational awareness without a verbal download.

## Prompt

## Context
You are a SOC (Security Operations Center) analyst assistant helping the outgoing shift analyst produce a clear, complete handover report. The incoming analyst may not share any context from the current shift. The report must let them pick up every open thread without asking.

Shift details:
- Analyst name: [ANALYST NAME]
- Shift date and hours: [SHIFT DATE AND HOURS]
- Open alerts and their current status: [OPEN ALERTS]
- Incidents investigated or escalated: [INCIDENTS]
- Actions taken (containment, tickets, escalations): [ACTIONS TAKEN]
- Watchlist items and IOCs (indicators of compromise) observed: [WATCHLIST AND IOCS]
- Tool or feed anomalies (SIEM, EDR, ticketing): [TOOL ANOMALIES]
- Anything needing immediate attention at shift start: [PRIORITY HANDOFF ITEMS]

## Task
Draft a shift handover report with these sections: Shift Summary, Open Alerts, Active Incidents, Actions Taken This Shift, Watchlist and IOC Notes, Tool and Feed Status, Priority Handoff Items.

## Standards
- Lead each section with the most time-sensitive item.
- Alert and incident entries include: ID or ticket number, asset or host involved, current status, and last action taken with a timestamp.
- Do not invent alert IDs, hostnames, IP addresses, CVEs, IOCs, or log lines that the analyst did not supply. If a field is blank, write "None reported this shift."
- Priority Handoff Items is a numbered list. Each item is one sentence with an owner or a recommended first action.
- Neutral operational tone. No jargon the incoming analyst would not recognize.
- Under 500 words.
- If any critical field (Open Alerts, Active Incidents) is blank and the shift had activity, ask the analyst to supply it before drafting.

## Variables

- ANALYST NAME
- SHIFT DATE AND HOURS
- OPEN ALERTS
- INCIDENTS
- ACTIONS TAKEN
- WATCHLIST AND IOCS
- TOOL ANOMALIES
- PRIORITY HANDOFF ITEMS

## Input checklist

- [ ] All open alert IDs and ticket numbers with their current status, pulled from your SIEM (Security Information and Event Management) or ticketing system, not from memory.
- [ ] Any active incidents, with escalation status and last action taken.
- [ ] IOCs, watchlist additions, or threat intel updates observed or added during the shift, sourced from your own tools and feeds, not generated by the AI.
- [ ] Notes on any tool outages, feed failures, or tuning changes that affect the incoming analyst.
- [ ] Data handling: redact credentials, customer PII (personally identifiable information), and anything classified before pasting, per your org's data-handling policy.
- [ ] Confirm all hostnames, IP addresses, and alert IDs come from your own systems and logs, not from the AI.

## Verification checklist

- [ ] Every alert ID and ticket number verified against your SIEM or ticketing system, not from memory or AI output.
- [ ] No IOCs or hostnames appear in the report that were not supplied by you, pulled from your own systems.
- [ ] Timestamps checked for accuracy and correct time zone, especially near shift boundaries.
- [ ] Priority Handoff Items reviewed for completeness: confirm no open thread was missed.
- [ ] No CVEs, malware families, or threat actor attributions cited unless you supplied them from a verified threat intel source.
- [ ] Incident status matches what is actually in the ticketing system at time of handover.
- [ ] No customer data, credentials, or sensitive internal details visible in the final report.

## Sample output

Sample output. Generated by AI from sample inputs:

SOC SHIFT HANDOVER REPORT
Analyst: M. Okafor | Shift: 2026-06-13, 23:00 - 07:00

Shift Summary. Moderate volume. One active incident escalated. Three alerts closed. SIEM feed from EDR (Endpoint Detection and Response) connector degraded for approximately 40 minutes starting at 02:15; restored at 02:57. No confirmed compromises this shift.

Open Alerts.
- ALT-4421 | Host: WEB-APP-03 | Repeated failed SSH logins from external IP | Status: Monitoring. Last action: IP added to watchlist at 03:14.
- ALT-4438 | Host: FILESERVER-02 | Unusual outbound data transfer at 04:50 | Status: Under review. Last action: Packet capture initiated at 05:03.

Active Incidents.
- INC-0891 | WEB-APP-03 brute-force attempt | Escalated to Tier 2 at 04:30. Awaiting senior analyst review. Tickets linked: ALT-4421.

Actions Taken This Shift.
- ALT-4399 closed (false positive, confirmed dev build process). 00:45.
- ALT-4412 and ALT-4418 closed (scheduled maintenance traffic, verified with IT ops). 01:30.
- External IP blocked at perimeter per playbook for INC-0891. 04:35.

Watchlist and IOC Notes.
- IP 198.51.100.44 added to watchlist (source: brute-force cluster on WEB-APP-03). Verify against threat intel before escalating.

Tool and Feed Status.
- EDR connector to SIEM: degraded 02:15-02:57. No events dropped; backfill confirmed at 03:05. Monitor for recurrence.

Priority Handoff Items.
1. INC-0891: Tier 2 review pending on WEB-APP-03. Check for callback traffic from that host.
2. ALT-4438 on FILESERVER-02: packet capture running, needs analyst review by 08:00.
3. EDR connector: if it degrades again, open a ticket with the platform team.

## Customization notes

Add a section for compliance or regulatory events if your environment is subject to PCI-DSS (Payment Card Industry Data Security Standard), HIPAA (Health Insurance Portability and Accountability Act), or FedRAMP auditing. Teams using automated SOAR (Security Orchestration, Automation, and Response) playbooks can add a Playbook Executions section. Adjust word limits for longer shifts with higher alert volumes. Junior analysts benefit from keeping the Priority Handoff Items section short and action-specific.

---

From The IT & Cybersecurity Library at vetslearn.com/libraries/it-cyber