01 - Introduction to SOC Operations

[!TIP] Industry Best Practice: Always align this domain with standard frameworks like OWASP, NIST, or CIS benchmarks for optimal security posture.

Theory & Architecture

A Security Operations Center (SOC) is a centralized function within an organization employing people, processes, and technology to continuously monitor and improve an organization's security posture while preventing, detecting, analyzing, and responding to cybersecurity incidents.

The Tiered SOC Model

Most mature SOCs operate on a tiered model to ensure efficient escalation and specialization.

Tier 1: Triage Specialist (The Frontline)

• Primary Duties: Continuous monitoring of SIEM (Security Information and Event Management) alerts.
• Actions: Basic triage, verifying if an alert is a True Positive or False Positive, initial data gathering.
• Goal: Filter out noise and escalate actual incidents to Tier 2 within the SLA (Service Level Agreement).

Tier 2: Incident Responder (The Investigator)

• Primary Duties: Deep-dive analysis of escalated incidents.
• Actions: Malware analysis, reviewing endpoint logs (EDR), determining the scope of the breach, and defining initial containment strategies.
• Goal: Uncover the root cause, fully map the attack using MITRE ATT&CK, and coordinate remediation.

Tier 3: Threat Hunter / SME (The Proactive Defender)

• Primary Duties: Proactive search for hidden threats that bypassed alerting mechanisms.
• Actions: Hypothesis-driven threat hunting, creating new detection rules, advanced forensics, and reverse engineering.
• Goal: Discover APTs (Advanced Persistent Threats) and improve the overall detection engineering lifecycle.

Core SOC Metrics

To measure the effectiveness of a SOC, several Key Performance Indicators (KPIs) are tracked:

1. Mean Time to Detect (MTTD):

   • The average time it takes the SOC to identify a potential security incident from the moment it occurs.
   • Lower is better. Highlights the effectiveness of detection tools and rules.

2. Mean Time to Respond/Resolve (MTTR):

   • The average time it takes to neutralize the threat and restore systems to a secure state after detection.
   • Lower is better. Highlights the efficiency of automated playbooks (SOAR) and the skill of Tier 2/3 analysts.

3. False Positive Rate:

   • The percentage of alerts generated by security tools that are benign or non-malicious.
   • High rate leads to alert fatigue. Detection engineering must continuously tune rules to keep this manageable.

The Threat Landscape for SOC

Modern SOCs face a barrage of attacks:

• Ransomware & Extortion: Rapid encryption and data exfiltration.
• Living off the Land (LotL): Attackers using legitimate administrative tools (PowerShell, WMI) to blend in.
• Identity-based Attacks: Credential stuffing, phishing, and MFA fatigue attacks targeting user access.