{"id":"sec-it-soc-shift-handoff","audience":"it-security","category":"security","track":"security","technique":"format","title":"Write a SOC shift handoff the day shift can act on","free":false,"task":"Write the handoff for the day shift from this night log. First line: 'Top priority:' plus the open item with the earliest deadline. Then at most 4 bullets: open items with their ID and next step, and one bullet listing the closed alert IDs. Use each item's latest status, and leave out anything that isn't a security item. Plain text, under 100 words.","materialLabel":"Night shift log (attached to your prompt automatically)","material":"SOC night shift log - Nov 5-6, 2026 (Aisha)\n\n22:05 INC-5120 opened: user p.green gave a third-party app called \"MailSync Pro\" access to their mailbox. Revoked the app's access. Waiting for the user to confirm whether they installed it on purpose.\n22:40 ALERT-2210: port scan from 203.0.113.12 against the VPN. Blocked by the firewall. Closed, no action needed.\n23:15 INC-5121 opened: an unknown script ran as SYSTEM on FILESRV-02. Host isolated from the network. Day shift needs a disk image for forensics. Omar (server team) must approve the downtime by 10:00.\n00:30 ALERT-2215: impossible travel for r.lee. Confirmed with the user: on vacation in Lisbon, using hotel wifi. Closed as false positive.\n02:10 INC-5120 update: p.green confirmed they installed it. Closed.\n03:45 INC-5120 REOPENED: same \"MailSync Pro\" access seen for k.ito and s.ward. Revoked both. Need to block the app for the whole company, which needs Global Admin approval (Marta).\n05:50 Floor 2 printer out of toner. Forwarded to facilities.\n06:55 Coffee order for the morning standup placed.","rules":[{"type":"plainText"},{"type":"maxBullets","max":4},{"type":"maxWords","max":100}],"mistakes":[{"title":"Retelling the night in order","why":"The AI walks through the log by time, so the 10:00 deadline is buried.","fix":"Say: \"First line: Top priority: the open item with the earliest deadline.\"","checks":["r0"]},{"title":"Using an old status","why":"The AI sees 'Closed' for INC-5120 and misses that it was reopened later.","fix":"Add: \"Use each item's latest status.\"","checks":["r1"]},{"title":"Keeping everything","why":"The AI lists every entry, including the printer, and gives closed alerts their own bullets.","fix":"Say: \"Leave out non-security items. Put closed alert IDs in one bullet.\"","checks":["r2","maxBullets"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 100 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 75 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the handoff channel they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Puts the deadline first","patterns":["top priority","earliest deadline","first line","deadline"]},{"label":"Uses the latest status","patterns":["latest","reopen","current status","most recent"]},{"label":"Limits the bullets","patterns":["\\b(4|four)\\b.{0,15}bullet","bullet.{0,20}\\b(4|four)\\b"]},{"label":"Drops non-security items","patterns":["printer","non-security","leave out","skip","coffee"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"A handoff is for the next person's first hour. Tell the AI what goes first, that statuses changed overnight, and what to leave out.","rubricLabels":["The first line starts 'Top priority:' and is about INC-5121 / FILESRV-02: getting Omar's downtime approval by 10:00 for the disk image","INC-5120 is shown as open (reopened, with k.ito and s.ward affected) and the next step is getting Marta's approval to block MailSync Pro company-wide","ALERT-2210 and ALERT-2215 appear only as closed items, and the printer and coffee notes are left out"]}