The handoff
The next person was not in the room. They need one sentence on what failed, a path to the file, the time, whether it is still happening, and what you already changed.
One sentence on what failed
Say the failure in the words of the evidence. “DMARC failed on a message that claimed to be from the company” is a sentence. “It looked phishy” is not. If nothing failed, say what you checked and what you did not.
One sentence. The rest of the note is there so they can check that sentence, not so they can reconstruct your afternoon.
The evidence path
Point at the case folder: the original file, the working copy, and the hash. A screenshot with no filename is a picture of a screen. The next person cannot hash a picture.
Write the path they can open, and the name of the file. If the lab only has a page in the browser, name that page and the sample it used. Do not paste the file into chat.
The time
Give the time the evidence names, and the zone. If you received the file later, give that time too, labeled. Do not collapse both clocks into “yesterday.”
A handoff with no time cannot be matched to a scope window or to another person’s note about the same host.
Whether it is still happening
Say yes, no, or that you do not know. “The message is in the mailbox and nobody has acted on it” is a status. “The host is still making the connection” is a status. Silence lets the next person assume it stopped.
If you do not know, write that. A guess that it stopped is worse than a blank, because they will not look.
What you already changed
List the changes you made, and the ones you did not. A revoked key, a quarantined message, a machine left powered on and off the network. If you changed nothing, say so. The next person should not undo a step you never took, or repeat one you already did.
The findings page is the note this handoff sits on. The case folder is where the file lives. The labs are where you practice the note before you owe it to someone else. A career conversation is the same shape: what failed, where the evidence is, and what you changed.