Arrange the usual handoff when monitoring identifies a serious suspicious event: CSIRT coordinates response, SOC monitors and detects, SOC validates and escalates, responders contain and investigate.

### The order 1. **SOC monitors and detects**: Ongoing observation provides the initial signal. 2. **SOC validates and escalates**: Analysts assess whether the signal is credible and important enough for response ownership. 3. **CSIRT coordinates response**: The response team organizes actions and stakeholders around the confirmed incident. 4. **Responders contain and investigate**: The team limits impact while determining scope and cause. ### The concept This is a typical workflow, not a claim that the SOC stops participating after escalation. Monitoring data can support the CSIRT throughout the incident, and organizations may combine the teams. The important distinction is that alert detection does not itself complete incident handling. ### Terms - **Escalation**: Passing an issue to a team or decision-maker with the authority or expertise to handle it. ### Remember Detect, validate, escalate, then coordinate response and technical action.