Method
How a System Bloompath engagement actually moves
This page describes the working pattern behind our SOC analytics and incident reporting work — observation first, artefacts second, handoff last.
We use the same spine for the flagship SOC Analytics Engagement and adapt it for reporting programmes, handoff packs, and briefings. The goal is always the same: artefacts your duty managers will still use after we leave.
Scope against real tickets
A short call and access checklist. We ask for a sample of closed high-severity tickets (redacted as needed) and a named SOC contact who can open doors on the floor.
Watch the shift, not the slide
We sit through handovers or remote screen shares during Hong Kong hours. Notes focus on language conflicts, missing fields, and moments where analysts invent context aloud.
Prototype with the people who will use it
Views and report outlines are drafted with duty managers in the room. Thresholds must map to ticket history. If we cannot defend a number, it does not ship.
Pressure-test on live work
We refine against an active queue — ideally a campaign week or a messy Monday — not a quiet sandbox. Friction notes become cuts, not new features.
Handoff workshop and runbook excerpts
We leave documented views, reporting templates, and short runbook excerpts. Ownership transfers to your team. Optional retainers are separate and never assumed.
Ready to map your next engagement?
Start with the SOC Analytics Engagement, or ask which lighter pack fits a narrower problem.