SOC Shift Handover & War Room UI in Figma

Quick answer

Shift handover UI keeps 24/7 SOC coverage without losing context when analysts swap. Design an open incident queue with severity, owner, and SLA clock; a handover briefing that captures what changed on shift; a war room mode for active incidents with roles, comms, and decision log; and escalation paths tied to alerting, automation, and runbooks. Start from the Figma guides hub and pair with threat hunting investigations, SIEM ingestion, posture dashboard, and Dev Mode handoff.

Who this is for

Product designers building SOC consoles, NOC-style war rooms, and shift-change workflows for enterprise Security Operations.
Design system teams aligning severity badges, countdown timers, and role chips with badges, tables, and progress indicators.
Engineering teams implementing shift schedules, incident ownership, briefing persistence, and war-room RBAC with audit trails.

Shift dashboard (start of shift)

ShiftDashboard
├── Header: Night shift · 18:00–06:00 UTC · On-call: Ana Liu · Backup: Marcus Chen
├── Summary: 7 open incidents · 2 overdue SLA · 14 unreviewed hunt hits
├── Incoming handover: Read briefing from Day shift · [ Acknowledge ] [ Add question ]
├── Priority queue:
│   ├── INC-8842 · Credential stuffing · Sev 1 · Owner: unassigned · SLA: 23m
│   ├── INC-8839 · WAF block spike · Sev 2 · Owner: Day shift · Needs reassign
│   └── HUNT-041 · Scheduled hit · 3 entities · Unreviewed since 4h ago
└── Actions: [ Claim incident ] [ Start war room ] [ View posture ]

Widget	Content
On-call roster	Primary, backup, IR lead, comms lead—link team roles
SLA clock	Time to acknowledge / resolve per severity tier
Unreviewed items	Alerts, hunt hits, automation failures
Posture snapshot	Delta since last shift from security posture dashboard
Maintenance window	Planned changes that may cause alert noise

Verdict: incoming analyst must acknowledge handover before claiming new work—prevents duplicate ownership.

Surface suspicious login volume if member-facing impact is active.

Handover briefing (outgoing shift)

HandoverBriefing
├── Shift: Day · Outgoing: Marcus Chen · Incoming: Ana Liu
├── Section 1: Active incidents (3)
│   ├── INC-8842 — Escalated Tier 2 · Waiting on identity team · Next: check auth logs 3–6 PM
│   └── INC-8839 — Monitoring · WAF rule tuned · No customer impact
├── Section 2: Decisions made
│   ├── Approved automation run #4521 (session revoke) · Documented in audit
│   └── Paused feed "Vendor-X" due to FP spike · [Threat intel](/designing-threat-intelligence-feeds-and-ioc-management-ui-in-figma/)
├── Section 3: Open questions
│   └── "Is partner VPN IP still allowlisted?" — link [IP allowlist](/designing-ip-allowlist-and-network-restrictions-ui-in-figma/)
├── Section 4: Watch list (next 12h)
│   └── Scheduled hunt "OAuth scope anomaly" · Large marketing email send at 8 PM
└── [ Submit handover ] [ Attach investigation links ] [ Flag for war room ]

Field	UI detail
Structured sections	Required fields—not freeform only
Incident deep links	Open investigation workspace at saved bookmark
Decision log	Who approved what; ties to audit log
Open questions	@mention incoming analyst; unresolved until checked
Watch list	Calendar events, deploys, hunt schedules
Attachment	Query snapshots, redacted screenshots—immutable

Use accordions for long incident lists; toasts confirm successful handover submit.

Incomplete handover: block outgoing analyst sign-off until required sections filled—except emergency break-glass override with audit reason.

Open incident queue

OpenIncidentQueue
├── Filters: Severity · Owner · SLA status · Source (alert/hunt/manual)
├── Sort: SLA breach risk desc
├── Row: INC-8842 · Sev 1 · Credential stuffing · Owner: Ana · SLA: 18m · War room: Active
├── Bulk: [ Reassign ] [ Merge duplicates ] [ Escalate IR lead ]
└── Empty: "No open Sev 1–2 · Review hunt hits or posture tasks"

Column	Handoff relevance
Severity	Color + icon consistent with alerting rules
Owner	Unassigned rows highlighted at shift start
SLA	Green / amber / red countdown
Source	Alert ID, hunt name, member report
War room	Chip if active session exists
Last update	Stale incidents (>4h no note) flagged

Right-click for context menu—Claim, Reassign, Link runbook, Open investigation.

Duplicate detection: suggest merge when same IOC or user anchors two incidents—common after alert storms.

War room mode (active incident)

WarRoom
├── Incident: INC-8842 · Credential stuffing · Started 2h 14m ago · War room live
├── Roles:
│   ├── Incident commander: Ana Liu
│   ├── Comms lead: (unassigned)
│   ├── Scribe: Auto-log enabled
│   └── SMEs: Identity · Network · Legal (invited)
├── Panels:
│   ├── Timeline — merged events from [investigation workspace](/designing-threat-hunting-queries-and-investigation-workspace-ui-in-figma/)
│   ├── Actions — [Run playbook step](/designing-incident-response-runbooks-and-security-playbooks-ui-in-figma/) · [Trigger automation]
│   ├── Comms — status page draft · exec notification template
│   └── Decisions — immutable log with timestamp + approver
└── [ End war room ] [ Export timeline ] [ Link compliance hold]

Panel	Purpose
Timeline	Live feed: alerts, automation runs, analyst notes, member locks
Actions	One-click runbook steps with approval gates
Comms	Pre-approved templates; legal review flag for external text
Decisions	”Block IP range” / “Pause feed” / “Escalate to exec” with rationale
Presence	Who is viewing war room—avoid conflicting actions

Scribe mode: auto-capture key events into decision log—analyst can edit before lock.

Escalate to PAM when containment needs elevated access.

Pair with notification routing—war room start notifies IR channel without paging entire org.

Escalation and on-call routing

EscalationPath
├── Sev 1: Tier 1 (5m) → Tier 2 (15m) → IR lead (30m) → Exec (60m)
├── Current: INC-8842 at Tier 2 · 8m in tier · Next: IR lead in 7m
├── On-call: Primary Ana · Backup Marcus · Override: [ Break-glass page ]
└── History: Paged Marcus at 3:22 PM · Acknowledged 3:24 PM

Tier	UI behavior
Acknowledge	Stops escalation timer; logged in audit log
Snooze escalation	Time-boxed; requires reason—not silent
Override on-call	Admin only; documents why primary unavailable
Exec notification	Pre-filled severity summary; no raw PII in SMS
Shift overlap	Both analysts see queue during 30m overlap window

Link session timeout—war room actions re-auth for destructive steps.

Shift metrics and retrospective strip

Metric	Shift view	Pairs with
Mean time to acknowledge	Per severity	Alerting rules
Incidents closed on shift	Count + FP rate	Investigation workspace
Automation success rate	Runs vs failures	Automation workflows
Hunt hits reviewed	% within SLA	Threat hunting
Handover completeness	Required fields filled	Posture dashboard
War room duration	Avg per Sev 1	Runbooks

End-of-shift prompt: “Add one line retrospective”—feeds weekly SOC review without separate form.

Use cards for metric tiles; drill to tables for incident list.

Common mistakes

Mistake	Why it hurts	Fix
Freeform-only handover	Incoming analyst misses critical context	Structured briefing sections
No acknowledge step	Outgoing leaves; incoming duplicates work	Require ack before claim
War room = chat only	Decisions lost in Slack threads	Immutable decision log in product
SLA hidden until breach	Reactive firefighting	Show time-to-breach on queue
Same UI for Sev 4 and Sev 1	Noise hides true emergencies	War room mode only for defined severities
No shift overlap	Gap in coverage at 6:00 AM	30m dual-access window
Escalation without ack tracking	Pages repeat endlessly	Ack stops timer; snooze requires reason
PII in exec SMS	Compliance violation	Template summaries only
No link to member recovery	Locked users during incident	Surface recovery status in war room
Stale owner after shift change	Incidents orphaned	Auto-prompt reassign at handover ack

Recommended workflow

Design shift dashboard with on-call roster, open queue, and handover ack.
Build structured handover briefing with incidents, decisions, questions, and watch list.
Add war room mode with roles, timeline, actions, comms, and decision log.
Wire escalation paths with ack, snooze rules, and exec notification templates.
Connect queue to investigations, runbooks, automation, and posture metrics.
Document RBAC and audit events in Dev Mode.

FAQ

Handover vs investigation workspace?

Investigation workspace is case-specific analysis; handover briefing is shift-level summary across all open work—link to investigations, do not duplicate full timelines.

War room vs incident runbook?

Runbook defines steps; war room is live execution UI with roles, comms, and decision log during active Sev 1–2 events.

Who can start a war room?

Tier 2+ or IR role by default; Tier 1 can request; team roles configurable per org.

Handover during active war room?

War room stays open across shifts—outgoing adds war room section to briefing; incoming ack inherits commander role or explicit reassignment.

Audit requirements?

Every handover submit, ack, escalation, and war room decision logs to audit log with actor and timestamp.

Next steps

Design threat hunting queries and investigation workspace UI in Figma — deep-dive cases linked from shift queue
Design incident response runbooks and security playbooks UI in Figma — steps executed inside war room
Design security alerting rules and notification routing UI in Figma — feeds open incident queue
Design security posture dashboard and compliance checklist UI in Figma — shift-level posture delta
Design audit log and security activity UI in Figma — immutable record of shift decisions

Designing security operations shift handover and war room UI in Figma: queues, briefings, and handoff