T1 / T2 / T3

T1, T2, and T3 refer to the three classic levels in a SOC. T1 triages alerts, T2 investigates incidents, and T3 handles complex cases, threat hunting, and detection engineering.

How it works

T1 analysts work through a queue and check alerts against checklists. They escalate anything they cannot clearly classify to T2. T2 analysts investigate the case in more detail. They gather evidence and initiate countermeasures. T3 provides support for difficult attacks. It also writes new detection rules and actively hunts for threats.

For example, a T1 analyst sees an alert for an unusual login. The analyst checks the location and device but finds no explanation. The Case is then escalated. The T2 analyst must get up to speed on the details and ask questions. More than an hour can pass between the initial alert and a decision.

What to look out for

• Handovers: Each tier transition consumes time and context. Ask about the average time per escalation.
• Analyst strain: T1 work is monotonous and has high staff turnover. This can compromise service quality.
• Night-time cover: Often, only T1 is staffed during the night. Clarify who has decision-making authority.
• The role of automation: Many T1 tasks can now be automated.

Why the model is under pressure

The tiered model originates from a time with little automation. Today, playbooks and AI handle a large part of the initial triage. The work is shifting towards experienced analysts who manage a case from start to finish.

Questions to ask a provider

If a provider works with tiers, ask what percentage of alerts are escalated. A high percentage suggests little automation or inexperienced staff on the first tier. Also ask how long an escalation takes on average, especially at night. Finally, clarify whether T3 support is available for your incident 24/7 or only during office hours.

How we implement it

We operate without a tiered structure. Initial triage is automated, and each Case remains with one experienced analyst until closure.