A Security Operations Center (SOC) is the team, and the set of processes and tools, that continuously watches an organisation's systems for signs of attack and responds when something is found. Prevention controls such as firewalls and hardening will eventually fail or be bypassed; the SOC exists to notice that quickly and limit the damage.
People, Process, Technology
| Pillar | What it covers |
|---|---|
| People | Analysts, engineers, hunters, managers; skills and training |
| Process | Triage workflow, escalation paths, playbooks, shift handover, reporting |
| Technology | SIEM, EDR, SOAR, ticketing, threat intelligence, network sensors |
A SOC with good tools but no defined process drowns in alerts; a SOC with good people but no telemetry is blind. All three have to mature together.
Core functions: detection (collecting telemetry and spotting malicious activity) and response (containing and handing off incidents). See Incident Response Process for what happens after an incident is declared.
Tiers and Roles
Alerts --> [L1 Triage] --> [L2 Investigation] --> [L3 Hunting / Engineering]
| | |
close / escalate confirm, contain, find what tools miss,
hand to IR build new detections
| Role | Responsibility |
|---|---|
| L1 analyst (triage) | Monitor the alert queue, validate alerts, close false positives, escalate real ones with notes |
| L2 analyst (investigation) | Deep-dive escalated alerts, correlate across sources, scope the incident, start containment |
| L3 analyst / threat hunter | Proactively hunt for threats that did not trigger alerts, handle the hardest cases, mentor |
| Detection engineer | Writes, tests and tunes detection rules and use cases (see SIEM and Log Management) |
| Threat-intelligence analyst | Turns external threat data into relevant indicators and context (see Threat Intelligence) |
| SOC manager | Staffing, shifts, metrics, budget, stakeholder reporting, process improvement |
Smaller SOCs combine these roles; larger ones add forensic analysts, malware reverse engineers and automation engineers.
Alert Lifecycle and Triage Workflow
- Generate - a rule, EDR detection or user report creates an alert.
- Enrich - add context: who owns the asset, is the user an admin, is the IP/hash known bad.
- Triage - decide whether it is malicious, benign or unclear.
- Investigate - pull related logs, check for activity before and after the alert.
- Decide - close as false positive, or escalate as an incident with a severity.
- Respond / hand off - contain, or pass to the incident response team.
- Document and tune - record findings; feed the outcome back into the detection rule.
Useful triage questions: What triggered it? Is the asset important? Is this behaviour normal for this user/host? Are there other alerts for the same host or user? Is there evidence of success (not just an attempt)?
True/false positives
| Real malicious activity | Benign activity | |
|---|---|---|
| Alert fired | True positive (TP) | False positive (FP) |
| No alert | False negative (FN) - the dangerous one | True negative (TN) |
Too many false positives cause alert fatigue: analysts start ignoring or rubber-stamping alerts, and real attacks get missed. The remedy is tuning (exclusions, thresholds, better context) and automation of repetitive enrichment, not simply hiring more people.
Key Metrics
| Metric | Meaning |
|---|---|
| MTTD (mean time to detect) | Average time from compromise (or event) to detection |
| MTTR (mean time to respond/resolve) | Average time from detection to containment or closure |
| Dwell time | How long an attacker stays undetected inside the environment |
| Alert volume / FP rate | Workload and quality of detections |
| Escalation rate, backlog age | Whether tiers and staffing are balanced |
| Coverage | Share of assets and attack techniques with usable detections |
Measure trends, not single numbers, and beware of metrics that can be gamed (for example, closing alerts fast without investigating).
SOC vs NOC vs CSIRT
| SOC | NOC | CSIRT / CERT | |
|---|---|---|---|
| Focus | Security monitoring and detection | Availability and performance | Coordinated incident handling |
| Typical trigger | Suspicious activity | Outage, latency, capacity | Declared security incident |
| Hours | Usually 24x7 | Usually 24x7 | Often on-call, may be inside the SOC |
They overlap and cooperate: a NOC may spot an outage that is really a DDoS; a CSIRT often takes over once the SOC escalates.
Tooling Stack
| Tool | Purpose |
|---|---|
| SIEM | Central log collection, correlation and alerting - see SIEM and Log Management |
| EDR / XDR | Endpoint (and cross-domain) telemetry, detection and remote containment |
| SOAR | Automates playbooks: enrichment, ticket creation, isolating hosts |
| Ticketing / case management | Tracks every alert and incident, supports audit and handover |
| Threat intelligence platform | Indicators, actor profiles, context for alerts |
| Network sensors | IDS/IPS, packet capture - see Wireshark, tcpdump, Security Technologies |
Staffing Models
| Model | Notes |
|---|---|
| In-house 24x7 | Maximum context and control; expensive (shifts, retention, training) |
| Business-hours in-house + on-call | Cheaper; slower overnight response |
| MSSP (managed security service provider) | Outsourced monitoring and alerting, often SIEM-based; check what response authority they have |
| MDR (managed detection and response) | Outsourced monitoring plus active response actions on your endpoints |
| Hybrid | In-house L2/L3 and engineering, outsourced L1 overnight ("follow the sun") |
Whichever model is used, define clear escalation contacts, authority to isolate systems, and data-handling terms.
Key Points
- A SOC detects and triages; deep incident handling follows the incident response process.
- Tiers split volume (L1) from depth (L2/L3); engineers and hunters improve detection over time.
- False positives are the main enemy of effectiveness; tune continuously.
- Track MTTD, MTTR and dwell time to show whether the SOC is improving.
Hands-on
- SOC Fundamentals - purpose, people, process, technology
- Introduction to Defensive Security - SOC and DFIR areas, simulated SIEM
- Tinsel Triage (Advent of Cyber 2025) - alert triage in Microsoft Sentinel