Typical split:
- 1st level: takes requests, records them properly, solves known cases such as password resets or standard configuration
- 2nd level: technical analysis with logs, configuration and reproduction, e.g. mail delivery, DNS, TLS, SSO
- 3rd level: engineering or vendor, fixes bugs in the product, ships patches
In smaller teams the lines blur, and one person often covers 2nd and 3rd level. More important than the label is clarity on who takes over when, and what must be documented at handover.
A healthy sign is when solutions from higher levels flow back to 1st level as knowledge base articles and get solved there directly next time.