ADVANCED SECURITY OPERATION CENTER
CYBERSECURITY BOOTCAMP
WEEK 6: ADVANCED SECURITY
OPERATION CENTER
PREPARED BY: Olagoke Faith
Disclaimer: This training material belongs to techcrush and shouldn’t be shared
SECURITY OPERATION CENTER
Security Operations Center (SOC) activities follow structured
workflows to detect, investigate, and respond to threats in real-time.
Typical SOC Workflow Stages
[Link] and Alerting
[Link] and Prioritization
[Link]
[Link] and Containment
[Link] and Remediation
[Link] and Reporting
[Link] Hunting and Proactive Defense
Disclaimer: This training material belongs to techcrush and shouldn’t be shared
ADVANCED SECURITY OPERATION CENTER
Daily SOC Activities by Stage
1. Log Monitoring & Alert Management
•Monitor SIEM dashboards (e.g., Splunk, QRadar, Azure Sentinel)
•Track and categorize incoming alerts (e.g., malware, suspicious login, lateral movement)
•Check threat intelligence feeds for IOCs
2. Triage and Alert Prioritization
•Evaluate:
• Severity
• Asset criticality
• Context (false positive vs. real threat)
3. Investigation
•Pivot across data sources (firewall logs, EDR, NetFlow, DNS, email logs)
•Run queries and correlation rules
•Perform endpoint analysis using EDR tools (e.g., CrowdStrike, Defender for Endpoint)
Disclaimer: This training material belongs to techcrush and shouldn’t be shared
ADVANCED SECURITY OPERATION CENTER
4. Response and Containment
•Isolate endpoints
•Revoke credentials or reset accounts
•Block IPs or domains at firewall/proxy
•Engage with IT or cloud teams if escalation is needed
5. Recovery
•Apply patches, clean systems
•Restore from backups
•Monitor for signs of reinfection or persistence
6. Documentation & Reporting
•Update tickets (e.g., ServiceNow, Jira)
•Write incident reports and timeline of events
•Share findings with stakeholders (weekly or ad hoc briefings)
Disclaimer: This training material belongs to techcrush and shouldn’t be shared
ADVANCED SECURITY OPERATION CENTER
Effective team collaboration and communication are critical in a SOC to ensure rapid detection,
analysis, and response to threats.
This involves:
•Clear Roles & Responsibilities: Defined roles (analysts, incident responders, threat hunters)
streamline workflows.
•Centralized Communication Tools: Platforms like Slack, Microsoft Teams, or integrated SIEM
chat functions enhance real-time coordination.
•Shift Handover Processes: Detailed briefings ensure continuity across 24/7 operations.
•Incident Response Playbooks: Standard procedures reduce confusion during high-pressure
events.
•Regular Briefings & Drills: Promote situational awareness and improve teamwork.
Disclaimer: This training material belongs to techcrush and shouldn’t be shared
ADVANCED SECURITY OPERATION CENTER
Metrics and Reporting in SOC Operations:
1. Key Metrics:
•MTTD (Mean Time to Detect): Time taken to identify threats.
•MTTR (Mean Time to Respond): Time to contain and remediate incidents.
•Number of Incidents: Total detected, investigated, and resolved.
•False Positives Rate: Indicates efficiency of detection tools.
•Analyst Utilization: Tracks workload and productivity.
2. Reporting:
•Daily/Weekly Dashboards: For operational visibility.
•Monthly Executive Reports: High-level trends, risks, and performance.
•Compliance Reports: For regulatory requirements (e.g., PCI-DSS, ISO
27001).
•Incident Summaries: Detailed post-incident reviews.
Disclaimer: This training material belongs to techcrush and shouldn’t be shared
SECURITY OPERATION CENTER
THE END!!!
Disclaimer: This training material belongs to techcrush and shouldn’t be shared
