Hand-offs: keeping one case record when two models share the queue

Where do hand-offs happen?

• SOAR to agent: a playbook enriches an alert and passes it to an AI SOC platform for investigation.
• Agent to SOAR: the platform reaches a verdict and hands response to playbooks. Dropzone AI works this way; its response runs through the connected SOAR.
• Agent to ticketing: Intezer, for example, routes incidents to SOAR and ticketing systems.
• Agent to analyst: any verdict the agent cannot settle, or any action that needs approval.
• Day team to provider and back, in a split model.

What makes a hand-off fail?

Three things, in practice. Nobody owns the alert in between, so it waits. The receiving side cannot see what the sending side already did, so it repeats work or contradicts it. Or the trigger is informal, such as someone remembering to post in a chat channel.

What rules prevent that?

1. One owner at a time. Every alert has exactly one current owner: a playbook, an agent, a named person or the provider. Ownership changes are logged.
2. One case record. Pick the system of record, usually the ticketing or case tool, and make every party write to it: verdicts, evidence, actions and notes.
3. Explicit triggers. Each hand-off fires on a defined condition, such as "verdict malicious and action needs approval", not on someone noticing.
4. A return path. If the receiving side cannot act, the alert goes back with a reason instead of waiting.

How do products affect this?

Products that work beside a SOAR, such as Dropzone AI, Intezer and 7AI, make the hand-off design your job: check where their verdicts and evidence land in your case tool. Conifers describes its product as a layer above existing SIEM, SOAR and XDR, which raises the same question. Products that replace the SOAR move more of the record into one place but make that product your system of record for automation.

How do you check the design?

Take five recent alerts of different types and walk each through the new design on paper. For each step, name the owner, the record and the trigger. A missing name or an empty record is a hand-off that will fail in production.

Who should own the design?

One named person, usually the SOC lead, should own the hand-off design and its changes. When a vendor, a provider or a new playbook enters the queue, that person updates the owner, record and trigger for each affected step. Without a single owner, the design drifts as each party optimizes its own part.

Words in this lesson: SOAR, Alert, Case record, Playbook, Investigation