SOC Analyst Foundations: T1 → T2

A recommended sequence from Tier 1 alert triage to Tier 2 investigation and incident response.