SOC Operations
Beginner 15 min read SOC Operations

What Is a Security Operations Center

The SOC is the team that watches, triages, and responds: how it's organized, what it owns, and how triage connects detection tools to incident response.

SOCtier 1tier 2triageescalationwatch floor
Prerequisites: The CIA Triad Intrusion Detection and Prevention
Introduction

What is this?

A SOC is the dedicated team, process, and tooling that monitors an organization's telemetry, triages alerts, and escalates incidents to skilled responders.

Motivation

Why do you need it?

  • Detection without a team is just storage — someone must decide 'this alert is real' convincingly and fast.
  • The SOC is the career door to security: tiered roles are how most analysts learn the trade.
  • Good SOC design (tiers, SLAs, tooling) is a response-invulnerability play: process beats heroics.
Think about it

Mental model

Imagine

The watch floor

Think of

Air traffic control

Planes (alerts) land constantly; the control team decides which flows deserve a full response crew.

Mechanics

How it works

  • Tier 1 analysts monitor queues, triage alerts as true/benign/unknown, and enrich with context.
  • Tier 2 analysts investigate escalated cases, contain, and capture lessons to improve detection.
  • The SOC owns tooling (SIEM, EDR, ticketing) and feeds lessons back into rules and playbooks.
  • Escalation path: alert -> triage ticket -> incident team with roles, timelines, and documentation.

The SOC escalation ladder

Alert
Triage
Escalate
Respond
Learn
Real world

In production

  • A 24/7 SOC spreads tier-1 shifts so the 3am alert is triaged with the same process as the 3pm one.
  • An org runs quarterly tabletop drills so the escalation path is muscle memory, not a first time.
  • A small team uses a managed detection service plus a 2-person SOC to cover weekends with playbooks.
Guidelines

Best practices

  • Define SLAs (time to acknowledge, time to escalate) and report them honestly.
  • Subscribe tier 1 to good context: enrichment, attach, and knowledge base before tools.
  • Document every playbook: containment, notification, evidence retention, and handoff.
  • Review every major incident to tune the detection that missed or the one that over-fired.
Watch out

Common mistakes

  • A 'SOC' that only copies alerts from one tool to a ticketing queue with nobody deciding anything.
  • Zero incident documentation: after the fire, nobody can attest to what was done.
  • Treating tier 1 as a dead end, losing the analysts who actually know the environment.
  • Alert tooling tuned to silence — the 'quiet SOC' is usually the blind one.
When things break

Debugging tips

  • When an alert looks real, ask 'what would prove it benign' and look for that evidence before escalating.
  • Start triage from the user/asset the alert names, then walk the telemetry outward.
  • Time-stamp everything; a later forensics pass needs the same clock.
Security

Security considerations

  • SOC staff handle sensitive telemetry; access to queues must be least-privilege and audited.
  • Evidence handling is part of the job: never alter the source, just annotate the copy.
Interviews

Interview checkpoint

Test yourself

Quick quiz

0/2
1

The primary job of a tier-1 analyst is...

2

A SOC without documented playbooks is...

Go deeper

Official documentation

SANS SOC survey / analysis
docs
MITRE ATT&CK defensive guidance
docs