← Back to notes SOC operations · Writing

Why most SOC handover tickets fail their first reader

A candid retro on the three failure modes we see most often in cohort handover writing — and the small habits that cure them.

Most junior analysts learn to investigate before they learn to write. That is fine for the first six months, less fine for the seventh, and visibly painful by the time they hand over to a Tier-2 colleague who has never seen the alert.

We have read a lot of cohort handover tickets at this point. Three failure modes show up over and over. The first: the analyst writes for themselves, not for the next reader. They use shorthand only they understand, skip context they happen to remember, and bury the actual recommendation in paragraph four. The second: the timeline is missing. There is plenty of "what happened" but no "when, in what order, and at what speed." The third: the recommendation is implicit. The analyst would tell you what to do next if you asked, but the ticket itself only describes what they did.

The cure is small. We teach a rubric: top of ticket states the situation in two sentences, second block states the timeline in bullet form, third block lists what was checked and ruled out, fourth block states the recommendation with a clear next-action owner. Nothing exotic. Practice it for two weeks and the next reader stops asking follow-up questions.

What surprises learners is that the rubric is not a template you fill in once. It is a thinking scaffold. Forcing yourself to state the situation in two sentences is what catches the cases where you have not actually understood the situation yet. The handover writes itself when the thinking is clear; it stays muddled when the thinking is muddled.