Incident escalation is the defined process for raising or transferring a security incident to personnel or organizational levels with greater authority or specialized capability. It coordinates investigation, ownership, response, and business-impact decisions when findings may indicate unauthorized access or compromise. section 11.1.7 section 11.1.10
A practical escalation workflow includes:
- Record the affected systems, severity, category, status, owner, reporting source, observed activity, and business impact. section 11.1.10
- Assign escalation authority explicitly; one case lists the chief information security officer as the escalation level. section 11.1.7
- Divide investigative responsibilities between specialists, such as a threat hunter examining a Linux server and the incident-response team examining a Windows server. section 11.1.7
- Monitor for suspicious outbound connections, suspicious files, and other malicious activity while the investigation continues. section 11.1.7
- Request outside capability when needed, such as an emergency incident-response provider and dark-web monitoring. section 11.1.10
Exposed firewall rule
Threat hunting found that a permissive GCP internet-firewall rule exposed Windows and Linux services. The case moved through the incident-escalation process: the threat hunter collaborated with incident responders, responsibilities were assigned by system, the FTP compromise and attempted access were documented, and external emergency response and dark-web monitoring were requested. section 11.1.10
