Cybersecurity Roadmap

Learn how to secure networks, applications, and systems against digital threats.

Overall Progress0%

SOC Operations

Explanation

A Security Operations Center (SOC) is the team that monitors an organization’s telemetry around the clock, turning raw logs into detections, detections into investigations, and investigations into response. The SOC’s core loop is: alert, triage, investigate, escalate. This lesson teaches how that loop works: the roles, the SIEM that centralizes logs, how detection rules fire, the difference between IOCs and IOAs, how threat hunting finds what rules miss, and the metrics that tell you if the SOC is actually working. You will simulate analyst work by reasoning over toy log events — no external tools required.

SOC Roles

Role	Responsibility
Tier 1	Monitor alerts, perform initial triage, escalate
Tier 2	Deeper investigation and response
Tier 3	Threat hunting, detection engineering, advanced analysis

The SOC Workflow

Telemetry

↓

SIEM

↓

Detection Rule

↓

Alert

↓

Triage

↓

Investigation

↓

Escalation

↓

Response

↓

Closure

Raw telemetry flows into the SIEM, rules raise alerts, analysts triage and investigate, and confirmed threats escalate to response before closure.

SIEM: Collection, Normalization, Correlation

Collection: gather logs from endpoints, network, auth, and cloud.
Normalization: convert logs into a common schema.
Correlation: link related events across sources.

Detection Rules and Alerts

Rules match patterns in normalized logs.
A good rule balances coverage with precision.
Alerts are signals for a human to examine — not conclusions.

False Positives vs False Negatives

	False Positive	False Negative
Meaning	Alert on benign activity	Missed real threat
Effect	Alert fatigue, wasted time	Undetected compromise
Fix	Tune rules, add context	Broaden coverage, threat hunt

IOC vs IOA

	IOC	IOA
Stands for	Indicator of Compromise	Indicator of Attack
Detects	Known-bad artifacts (hash, domain)	Attacker behavior (lateral movement, C2)
Strength	High precision, known threats	Catches novel attacks

Threat Intelligence and MITRE ATT&CK

Threat intelligence provides context on adversaries and their techniques.
MITRE ATT&CK is a framework of real-world adversary tactics and techniques.
Mapping detections to ATT&CK reveals coverage gaps.

Threat Hunting

Proactively search for threats that rules did not catch.
Start from a hypothesis (a technique, a behavior) rather than an alert.
Findings feed back into new detection rules.

Telemetry Sources

Source	What it tells you
Endpoint (EDR)	Process, file, and registry activity
Network	Connections and traffic patterns
Authentication logs	Who logged in, from where, when
Cloud logs	API calls and configuration changes

SIEM vs EDR

	SIEM	EDR
Scope	Centralized logs across the org	Deep visibility on each endpoint
Strength	Correlation across sources	Detailed process/host behavior
Relationship	Aggregates and correlates	Feeds rich endpoint data into the SIEM

Case Management and Evidence Preservation

Track every investigation in a case with notes and evidence.
Preserve evidence in its original form for later analysis.
A good case record makes escalation and handoff clean.

Escalation and Incident Handoff

Escalate when an alert is confirmed as a real threat.
Hand off with the full case context to incident response.
Clear handoff prevents duplicated or dropped work.

SOC Metrics

Metric	Meaning	Why it matters
MTTD	Mean time to detect	How fast threats are found
MTTR	Mean time to respond	How fast threats are handled
Detection coverage	What techniques you can detect	Gaps attackers can hide in

Alert Fatigue and Playbooks

Too many false positives desensitize analysts and hide real alerts.
Tune rules and deduplicate to keep signal high.
Playbooks give analysts a consistent, repeatable response per alert type.

Examples

A realistic SOC investigation (toy logs)

Three correlated events arrive in the SIEM.

text

108:12  login success  user=alice  src=203.0.113.99  geo=US208:14  login success  user=alice  src=198.51.100.7   geo=NL308:20  data export    user=alice  volume=2GB  to=external4 5Hypothesis: impossible travel + large egress = compromised account

Output

(correlation across sources turns noise into a signal)

False positive or real?

Deciding whether an alert needs escalation.

text

1Alert: failed logins x5 for user=alice2Context: alice is on leave, no known travel3Decision: escalate — the context makes it suspicious4 5Alert: failed logins x5 for a printer account6Context: routine maintenance window7Decision: triage as likely false positive

Output

(context determines whether an alert escalates)

Key Takeaways

The SOC turns telemetry into detections, investigations, and response.
Triage is a fast first pass; investigation confirms the threat.
IOCs detect known artifacts; IOAs detect behavior.
Correlation across sources turns noise into signal.
Tune rules to fight alert fatigue; hunt to find what rules miss.
Metrics (MTTD/MTTR/coverage) tell you if the SOC is improving.

← PreviousMalware Analysis Next →Incident Response