TryBench
Writing an Incident Escalation Brief
Combine defanged indicators, redacted user secrets, and containment status into a shift handover brief.
Why this matters
When a senior person takes over an incident, they need clear facts fast. A tidy, safe ticket saves minutes when minutes matter.
Answer Who, What, and Status
When you hand an incident to a senior lead, long paragraphs waste time. Use a short, scannable format.
In real life: A good handover answers three things: what happened, which machine, and what is the status. Skip the long story.
Make Links Safe and Hide Passwords
Use everything you learned. Defang each bad domain with [.], replace any leaked password with [PASSWORD], and note if the computer is isolated.
In real life: Use what you learned before: make links safe with [.] and hide passwords. Never put a real password in a ticket.
Use Raw JSON for the Ticket
Write the ticket as clean JSON. Then the security dashboard can read it without anyone copying and pasting.
In real life: JSON lets the security dashboard read your ticket directly. No one has to copy and paste the details.
Your practice task
Turn the raw shift notes below into a safe escalation ticket. Have the AI defang the phishing domain with [.], replace the leaked password with [PASSWORD], and return raw JSON only (no ``` marks) using keys: defanged_domain, leaked_secret, and affected_host.
How to do it
- Read the raw shift notes above.
- Ask the AI to defang the phishing domain with [.].
- Ask it to replace the leaked password with [PASSWORD].
- Ask for raw JSON with defanged_domain, leaked_secret, affected_host. Press Run proof.
Practice it for free in the app. You get instant checks that show what you got right and what to fix. A lesson takes about two minutes and you can try as many times as you like.
Quick reference: SOC Shift Escalation Brief
Standard handover format for Tier-1 security analysts.
Convert raw notes into a JSON ticket with defanged_domain (dots replaced with [.]), leaked_secret ('[PASSWORD]'), and affected_host. No markdown fences.More lessons in this course
- Why Attackers Target AccountsUnderstand the CIA triad and why attackers seek credentials to siphon money and corporate data.
- Passphrases & Multi-Factor ArmorReplace weak passwords with long passphrases and upgrade from SMS OTPs to authenticator apps.
- Phishing Email Red Flags: How to Spot a FakeIdentify manipulative urgency, spoofed headers, and fake penalties in phishing communications.