Field guide / Reviewed October 31, 2026

Make the next question obvious.

A useful handoff lets another analyst continue the investigation without reconstructing what you checked.

Lead with the problem and the boundary.

Write one sentence describing why the case needs attention, followed by the affected entities, the time window and available sources. Avoid starting with a long dump of unfiltered events. Keep the raw evidence in its approved store and reference it.

Elastic describes notes and cases as ways to preserve findings and investigation context. CaseNote's exported ticket follows that principle but performs no case-system integration. Elastic cases and notes overview.

A complete synthetic handoff.

Summary: A successful sign-in for training user-07 needs identity-owner review because device context and expected activity are unresolved.

Scope: 09:00-09:30 UTC on October 30, 2026. Only training records S1 and A1 were available.

Observed: E1/S1 reports sign-in success at 09:12 UTC. E2/A1 records a profile-setting read at 09:14 UTC. Session correlation is not supplied.

Hypothesis: Activity may be unauthorized. An approved VPN or device change could also explain the sign-in.

Gaps: Device context, source retention, wider audit history and owner confirmation were not checked.

Actions: Reviewed the two records. No containment performed.

Request: Identity team to establish device context and correlate the records. Review time must be assigned under the local playbook.

Use these distinctions consistently.

• Observed: “The source reports success.” Keep the source reference.
• Hypothesized: “The activity may be unauthorized.” Say what would change your view.
• Unavailable: “The relevant log was not supplied.” Explain the access or coverage gap.
• No match: “The specified query found no matching events in this source and interval.” Preserve the query boundary.
• Action taken: “An authorized responder revoked the session at the recorded time.” Record evidence of result, not just intent.

A handoff can be incomplete and still useful.

Missing fields should be visible. Do not fill them with plausible details to make a ticket look complete. If you cannot identify the next owner, say who needs to assign one. If you do not know the deadline, use your team's escalation process rather than inventing one.

The worksheet allows export with open checks because escalation often happens before an investigation is complete. The export states those checks and never calculates a safety score. Prepare your handoff.