SOC: what a Security Operation Center is

In short

A SOC is made of three things: people who know how to read an alert, processes that say what to do in each case, and tools that collect the data, such as the SIEM and the agents on the endpoints. Without any one of the three the SOC does not work: tools without people produce alerts nobody reads, people without tools see nothing.

How it works

The typical activities are:

• continuous monitoring of events and alerts;
• triage: separating false positives from real events and assigning a severity;
• analysis and response: understanding what is happening and containing it, working with the people who run the systems;
• threat hunting and the use of threat intelligence to look for what the alerts do not show;
• improvement: new detection rules, noise reduction, periodic reports.

Many SOCs organise their analysts in tiers: the first tier sorts the alerts, the second investigates, the third deals with complex cases and threat hunting.

In-house or outsourced, 8/5 or 24/7

An in-house SOC running day and night needs several specialists just to cover the shifts: an investment beyond the reach of most SMEs. The alternative is a SOC entrusted to a provider, often sold as an MDR service. The practical choice concerns cover: during business hours (8 hours, 5 days) or continuous (24 hours, 7 days), and who decides on containment actions.

A SOC is not the same as a CSIRT: the first monitors and detects continuously, the second steps in to handle the incident, with roles that are not only technical. In many organisations they work closely together.

Not to be confused with SOC 2

The acronym SOC 2 has nothing to do with the Security Operation Center: it is a US audit standard (System and Organization Controls) covering the controls of a service provider. We cover it on the SOC 2 page.

Example

At 22:40 an alert comes in: an account in the finance department has made dozens of failed logins to email and then a successful one from an unusual country. The SOC analyst checks that it is not a business trip, reports what happened to the company's contact person and proposes blocking the account and changing the password. The next morning the company finds on its desk the event, the actions taken and those still to be decided.

Related terms

• MDR
• CSIRT
• SIEM
• XDR