AD5.10 When to Escalate

Escalation criteria by target

Handle yourself (no escalation): Single user credential compromise blocked by CA003. Single phishing email caught by Safe Links. Single DLP match with appropriate override. These are the routine incidents your Monday review catches and your AD1-AD4 procedures resolve. Response time: during the Monday review or within 24 hours if flagged by notification.

Escalate to your manager: Confirmed credential compromise with successful sign-in (the attacker got in, even briefly). Multiple users affected by the same phishing campaign. DLP match indicating bulk data exfiltration. Secure Score drop caused by another admin's configuration change. Your manager needs awareness for two reasons: the incident may affect business operations, and the response actions (password resets, account lockouts) may generate user complaints that your manager should be prepared for.

Escalate to managed SOC (if available): Any high-severity incident you're not confident handling alone. Multi-user compromise. Indicators of ransomware (bulk file encryption, VSS deletion, unusual service creation). After-hours high-severity alerts. Your managed SOC has analysts with deeper investigation skills and 24/7 coverage. Provide them with: the incident ID in the Defender portal, the affected user(s), the timeline of events, and the actions you've already taken.

Escalate to legal / senior management: Any incident involving confirmed personal data exposure (GDPR 72-hour notification clock starts). Any incident involving executive accounts (CEO, CFO — potential for financial fraud). Any incident where the attacker had access long enough to potentially exfiltrate data. Legal needs to assess notification obligations. Senior management needs to assess business impact and communication.

Escalate to external IR provider: Ransomware confirmed on any system. Evidence of persistent access by a sophisticated attacker. Any incident beyond your technical capability or the managed SOC's scope. External IR providers bring forensic tools, legal experience, and insurance claim support that internal teams typically lack.

The escalation handoff template

When you escalate, provide this information so the responder can act immediately:

Incident Summary:

• What happened: [one sentence — "User j.morrison's account was compromised via AiTM phishing"]
• When: [first indicator timestamp — "First suspicious sign-in at 01:15 on Saturday 12 April"]
• Who: [affected users and systems — "j.morrison's mailbox, 3 inbox rules created"]
• Scope: [how many users, what data — "1 user confirmed, checking for others"]
• Current state: [contained or active — "Sessions revoked, password reset, inbox rules deleted"]
• Actions taken: [what you've done — "Executed AD1.9 procedure at 09:30 Monday"]
• What's needed: [why you're escalating — "Need deeper mailbox forensics to determine what emails were forwarded"]

This template takes 5 minutes to fill in from your investigation notes. It gives the responder everything they need to continue without repeating your work.

Coordinating with a managed SOC partner

If your organization uses a managed SOC (like NE's BlueVoyant), establish the coordination workflow before you need it. During the onboarding or service review meeting, agree on:

What the managed SOC monitors: Typically Defender for Endpoint alerts, email threat detections, and identity risk signals. They DON'T monitor your Intune compliance, DLP policies, SharePoint sharing, or Secure Score — that's your monitoring cadence.

How to escalate to them: Email address, phone number, ticket system, or portal. Some managed SOCs require specific incident IDs from the Defender portal. Some accept free-form email. Know the process BEFORE the incident.

What information they need: The Defender incident ID (they can pull the details from their portal access), the affected user(s), a brief summary of what you've already done (sessions revoked, password reset), and what you need from them (deeper investigation, 24/7 monitoring of the account, forensic analysis).

What they do vs what you do: The managed SOC investigates and contains. You communicate with the affected user, coordinate with management, handle the business impact, and implement post-incident improvements. The division is: they handle the security response, you handle the organizational response.

Response SLAs: Your managed SOC contract includes response time commitments. Know them: typically 15 minutes for critical/high severity, 1 hour for medium. If they don't meet the SLA, escalate through your account manager. During an incident is not the time to discover that your SOC partner's response time is 4 hours.

When external IR is needed

External incident response is the escalation beyond your managed SOC. The triggers are specific:

Ransomware confirmed: Ransomware requires forensic analysis (determining the initial access vector, assessing the encryption scope, evaluating backup integrity), legal assessment (notification obligations, insurance claims), and recovery planning (clean rebuild vs decrypt vs pay). This is specialist work that most managed SOCs don't fully cover.

Confirmed data exfiltration: If investigation confirms that sensitive data was exfiltrated (not just accessed, but actively removed from your environment), legal and regulatory obligations may apply. External IR providers coordinate with legal counsel and insurers to manage the response correctly.

Sophisticated persistent attacker: If investigation reveals that the attacker has been in your environment for weeks or months (persistence mechanisms, backdoor accounts, modified configurations), eradication requires a thorough assessment that's beyond the scope of a weekly Monday review. External IR provides the deep-dive investigation and comprehensive eradication plan.

If you don't have an external IR retainer, document this gap in your quarterly report: "No external IR retainer — incident response capability limited to internal procedures (AD1-AD5) and managed SOC partner. Recommendation: evaluate IR retainer for ransomware and data breach scenarios." This is a risk acceptance that management should be aware of — and may justify budgeting for an IR retainer in the next financial year.

Preserving evidence before escalation

When you escalate, the responder needs evidence that you may inadvertently destroy if you're not careful. Before escalating, take these preservation steps:

Don't delete anything. When you find a malicious inbox rule, disable it — don't delete it. The rule's creation timestamp, configuration, and the account that created it are evidence. When you find a suspicious file, quarantine it — don't delete it. When you find a rogue service principal, disable it — don't remove it. Deletion destroys forensic evidence that the IR team needs.

Screenshot everything. Before taking any containment action, screenshot the current state: the inbox rules page showing the malicious rule, the sign-in log showing the suspicious sign-in, the incident page showing the attack story. After you revoke sessions or reset passwords, the attacker's active session disappears — the screenshot is the evidence that it existed.

Export sign-in data. Before the sign-in log rotates (default retention: 30 days for Entra ID P1), export the relevant entries:

$user = "r.williams@northgateeng.com"
$startDate = "2026-04-10T00:00:00Z"
Get-MgAuditLogSignIn -Filter "userPrincipalName eq '$user' and createdDateTime ge $startDate" -All |
    Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName,
        @{N="IP";E={$_.IpAddress}},
        @{N="Location";E={"$($_.Location.City), $($_.Location.CountryOrRegion)"}},
        @{N="Device";E={$_.DeviceDetail.OperatingSystem}},
        @{N="MFA";E={$_.MfaDetail.AuthMethod}},
        @{N="CA";E={$_.ConditionalAccessStatus}},
        @{N="Risk";E={$_.RiskLevelDuringSignIn}} |
    Export-Csv -Path "C:\Evidence\$user-signins-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "Exported sign-in data to C:\Evidence\"

Record the timeline. Write down, in chronological order: when you discovered the incident, what you found, what actions you took, and when. This timeline is the first thing the IR team asks for. Having it ready saves 30 minutes of reconstruction during the handoff call.

The post-incident improvement cycle

After every escalated incident is resolved, schedule a 30-minute review with yourself (or with your manager if they were involved). Answer three questions:

1. How was the incident detected? Was it the Monday review, an alert notification, a user report, or accidental discovery? If it was accidental discovery, what monitoring check should have caught it earlier?

1. What could have prevented it? Would a different CA policy have blocked the attack? Would user training have prevented the phishing click? Would a DLP policy have caught the data exfiltration? Each answer becomes a potential improvement action for the next quarter.

1. What would you do differently next time? Was the escalation timely? Did you preserve the right evidence? Did the handoff template contain enough information? Each answer improves your response procedure.

Document the answers in a brief "lessons learned" note and file it with the incident record. After 4 incidents, you have a pattern: "3 of 4 incidents involved AiTM phishing — consider implementing conditional access token protection" or "2 of 4 incidents were discovered during the Monday review — the monitoring cadence is working." These patterns feed your quarterly report's "next steps" section with data-driven recommendations.