SOC operations

The SOC (Security Operations Center) is the team and process that continuously monitors, detects, and responds to threats. This card covers how it’s organized, the analyst’s workflow, and the metrics that tell whether it works.

Functions and tiers

Tier 1   alert triage: filter false positives, escalate the real ones
Tier 2   deep investigation: correlation, context, initial containment
Tier 3   hunting (def-hunting), advanced IR (dfir), detection engineering
Support  threat intel (cti-fund), detection engineering, automation (SOAR)
Models   internal 24/7, hybrid, or external MDR/MSSP

Workflow (alert → close)

1. DETECTION    alert from the SIEM/EDR (def-siem/def-edr)
2. TRIAGE       true/false positive? severity, affected assets and users
3. INVESTIGATION  enrich (TI, identity, asset), reconstruct what happened
4. CONTAINMENT  isolate host, disable account, block IOC (SOAR speeds this up)
5. RESPONSE     move to IR if it's an incident (dfir): eradicate and recover
6. CLOSE        lessons learned -> new detection/process improvement

Metrics that matter

MTTD   mean time to detect   (lower = less dwell time)
MTTR   mean time to respond
False positive rate  (high = alert fatigue = burned-out SOC)
ATT&CK coverage  detectable techniques vs. gaps
Alert volume per analyst (team sustainability)

SOAR and automation

SOAR   playbooks that automate repetitive tasks: enrich IOC, isolate host,
       disable account, open ticket, notify
-> frees the analyst for the work that needs a human brain

Chronic problems (and how to attack them)

Alert fatigue    too many noisy alerts -> aggressive tuning, context, automate triage
Burnout          tough 24/7 shifts -> rotation, automation, career path
Visibility gaps  unlogged sources -> prioritize high-value telemetry
Lack of context  integrate CMDB/identity/TI into the analyst console

Blue Team / operation

Document runbooks per alert type (what to check, how to respond) for consistency.
Measure and improve MTTD/MTTR and ATT&CK coverage; retro after each incident.
Loop with detection engineering (Detection & logging) and hunting (Threat hunting): each case improves the system.
Align with the business: prioritize by critical assets (see Vulnerability management) and risk (Risk management).

Real-world cases

Breaches with high dwell time from a SOC drowning in false positives (M-Trends).
Target (2013): the alert existed but triage didn’t escalate it → massive breach; a SOC-process case study.
Organizations that automated triage with SOAR cut MTTR dramatically (vendor cases).

Testing checklist

Tier structure and model (internal/MDR) defined
Runbooks per alert type documented
Triage→containment→IR flow operational (with SOAR where it helps)
MTTD/MTTR, false positive, ATT&CK coverage metrics
Context integration (TI, identity, assets) in the console
Lessons-learned process → new detections
Alert fatigue and burnout prevention (tuning, rotation)