In a tiered SOC, which alerts may a tier-1 analyst close unaided and which must go to tier-2?

## What a "tier" actually is A tier is a written statement of which conclusions a person may reach, and which actions they may take, **without a second pair of eyes**. It is not a seniority label and it is not a difficulty rating. Two analysts with identical skill can sit at different tiers in two SOCs because the two organisations wrote different boundaries. This matters in an interview because the weak answer is "tier-1 does easy alerts, tier-3 does hard ones", which gives an interviewer nothing to test. The boundary exists because a SOC has to make many decisions per shift with very few people who can make all of them. Tiering trades depth for throughput: it lets you hire people who cannot yet work a whole case, and it protects the scarce senior from a queue. ## The three dispositions, and why the distinction is load-bearing - **False positive** — the detection was wrong about maliciousness. The thing it claimed happened either did not happen, or does not mean what the rule assumed. - **Benign true positive** — the behaviour genuinely happened, and it was authorised or expected. A backup account really did read every file share; an administrator really did run a remote command. - **True positive** — the behaviour happened and it is unauthorised. Tier-1 authority normally covers the first two, and only where the playbook names the evidence that separates them. A candidate who says "tier-1 handles false positives" has missed that most tier-1 closes are benign true positives, which are harder, because you have to establish that a real action was authorised rather than that nothing happened. ## What a good escalation criterion looks like Criteria have to be checkable by the person applying them at 03:00, not by the person who wrote them at a whiteboard. Usable ones look like: - **No playbook exists for this detection** — escalate. "Use your judgment" is not a criterion; it is the absence of one. - **The playbook ran out and the case is still open** — escalate, with the negative results attached. - **Evidence of success rather than attempt** — a failed authentication burst is an attempt; one success after that burst is a different case. - **Asset or identity class** — domain controllers, identity providers, build systems, privileged and service accounts. - **The required action exceeds tier-1's rights** — if resolving the case needs a host isolated, an account disabled or a session revoked and tier-1 may not do it, the case is not tier-1's to hold. - **Multiple related alerts on the same host, account or time window** — the pattern is a different finding from any single alert in it. Notice that every one of these can be answered yes or no from what is on the screen. ## The asymmetry candidates get backwards Escalating a benign alert costs a tier-2 analyst some minutes. Closing an intrusion costs you the dwell time until somebody else finds it — often an outsider. So the two errors are not symmetric, and the burden of proof sits on the **close**, not on the escalation. That said, a tier-1 who escalates everything has quietly abolished tier-1: the queue simply moves up a floor, tier-2 saturates, and the escalations stop being read carefully. The fix for over-escalation is more playbook coverage and better enrichment, never a rule that says "escalate less". The reverse failure is the dangerous one: a tier-1 under queue pressure learns that closing keeps the numbers healthy and nobody ever comes back to complain. A closed alert generates no feedback, which is exactly why closing is the decision that needs the written authority. ## What tier-2 and tier-3 add Tier-2 is usually granted deeper investigation — pivoting across data sources, pulling artefacts from the host, correlating across cases — and a broader set of actions. Tier-3 typically covers the judgments that cannot be reduced to a playbook at all: whether a set of findings amounts to an intrusion worth escalating into the incident process, and hands-on forensic work. Whether an intrusion is formally **declared**, and by whom, is a separate authority again, sitting in the incident-response process rather than in the triage queue. ## The answer that impresses Say that the boundary is written, that it is expressed as checkable criteria rather than judgment, that it covers actions as well as conclusions, and that when the criteria are silent the default is escalate. Then add the honest caveat: the boundary is only real if somebody keeps the playbooks current, because a tier model with stale playbooks is a model where tier-1 closes on vibes and the escalation criteria describe a SOC that no longer exists.