By role · SOC Manager
The shift ends. The context does not.
Continuity is the SOC's hardest problem; it dies at seven in the morning. Rota, escalation, workload and a signed handover keep it alive. Cases and incident records are yours to close — or to delete.
What this replaces
- The night's context is three chat messages and one person's memory.
- Two analysts land on one case while three others sit untouched since Friday.
- One incident type has three names, depending on who typed it first.
What you do here
- 1Plan the rota and the escalation path.On-call order, coverage and escalation policy sit with the roster, on the screen where the shift is planned.Shift management
- 2Balance the queue analyst by analyst.Claim, assign or reassign a case; every move lands in the assignment history with a name against it.Analyst workload
- 3Hand over on a record the next shift signs.Draft, submit, acknowledge. The next crew inherits what happened in writing.Shift handover
- 4Backfill the month you never measured.Analyst performance and KPI snapshots keep a history; a gap in the record can be filled in afterwards.SOC KPIs
- 5Fix one name per incident type.Conflict detection in the naming registry stops two analysts inventing two labels for the same thing.Naming registry
- 6Turn a capability gap into a roadmap item.Best practices you have not adopted are tracked as gaps, then sequenced. The roadmap comes out of the assessment.SOC best practices
What changes
- The next shift starts from a signed handover record, not from yesterday's chat scrollback.
- Assignment history names who claimed each case and when, per analyst and per shift.
- Eight screens carry the shift: dashboard, cases, shifts, workload, handover, KPIs, best practices, roadmap.
Case managementShift handoverAnalyst workloadOn-call rotaSOC KPIsIncident taxonomyNaming registry
Where the role stops
Assets stay read-only to you. You run the SOC, not the programme: governance, risk and compliance sit with the desks that own them.
Works with
- Security AnalystTriage from the case queue, then live inside the incident record: IOCs, evidence and timeline as you go. Check whether this happened before, then hand the fix on as a task with a date on it.TRIAGE
- Security ManagerOwn the operational day: the vulnerability queue, incidents from triage to lessons learned, access certifications, hardening sign-offs and phishing rounds. Each carries an owner, a date and a record behind it.OPS
- IT ManagerAn inventory is accurate on the day it was exported. Here the register stays live, exceptions are written decisions and each system is scanned against its baseline with the hardening add-on.ASSETS
Ready to move
beyond legacy GRC?
14-day free trial. No credit card. Cloud or on-premises.