Scribd
Upload
2K views2 pages

Sample SOC Standard Operating Procedures

The Sample SOC Standard Operating Procedure (SoP) outlines the roles, responsibilities, and processes for Security Operations Center (SOC) operations, including 24x7 monitoring and incident response. It details the incident lifecycle, classification, investigation process, escalation protocol, and post-incident activities, along with tools and technologies used in SOC. Additionally, it emphasizes compliance mapping to relevant standards such as NIST 800-61 and ISO/IEC 27035.

Uploaded by

home dial
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
2K views2 pages

Sample SOC Standard Operating Procedures

The Sample SOC Standard Operating Procedure (SoP) outlines the roles, responsibilities, and processes for Security Operations Center (SOC) operations, including 24x7 monitoring and incident response. It details the incident lifecycle, classification, investigation process, escalation protocol, and post-incident activities, along with tools and technologies used in SOC. Additionally, it emphasizes compliance mapping to relevant standards such as NIST 800-61 and ISO/IEC 27035.

Uploaded by

home dial
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 2

Sample SOC Standard Operating Procedure (SoP)

📘 1. Introduction
• Purpose: Define roles, responsibilities, and processes for SOC operations.
• Scope: Covers 24x7 monitoring, incident detection, response, and
escalation.
• Audience: SOC analysts, incident responders, management, IT, compliance
teams.

2. SOC Roles & Responsibilities


Role Responsibility
Tier 1 Analyst Monitor alerts, triage incidents, escalate as needed
Tier 2 Analyst Investigate escalated incidents, perform threat hunting
Tier 3 / IR Lead incident response, coordinate with stakeholders
SOC Manager Oversee operations, reporting, and team performance

🚦 3. Incident Lifecycle & Classification


Incident Categories:
• Unauthorized access
• Malware detection
• Insider threat
• DoS/DDoS attacks
• Data exfiltration
Severity Levels:
Severity Description Response Time
Critical Active breach/data loss Immediate
High Threat detected with impact <30 mins
Medium Suspicious behavior <4 hours
Low Informational Next business day

📡 4. Detection & Monitoring


• Use [SIEM tool] for real-time log analysis.
• Set up correlation rules for known threat patterns.
• Integrate threat intelligence feeds.

🔍 5. Investigation Process
1. Validate the alert (false positive check).
2. Correlate with logs (firewall, EDR, proxy, etc.).
3. Check for known indicators of compromise (IOCs).
4. Assign severity and document findings.

📈 6. Escalation Protocol
• Tier 1 ➡ Tier 2 ➡ Tier 3 ➡ CISO or IR team
• Use internal ticketing (e.g., ServiceNow/JIRA)
• Notify stakeholders via email/chat for critical incidents.

🧪 7. Containment & Eradication


• Isolate affected endpoints
• Revoke compromised accounts
• Remove malware using EDR/AV tools
• Patch vulnerabilities

🧾 8. Post-Incident Activities
• Root Cause Analysis (RCA)
• Lessons learned workshop
• Update detection rules/playbooks
• Submit incident report (within 24-72 hours)

9. Shift Handover Process


• Daily briefing: key incidents, pending investigations
• Use handover template with:
○ Ongoing tickets
○ Critical system status
○ Upcoming maintenance

🧰 10. Tools & Technologies


• SIEM: [Splunk / QRadar / Sentinel]
• SOAR: [Cortex XSOAR / IBM Resilient]
• Threat Intel: [AlienVault OTX / MISP]
• EDR/XDR: [CrowdStrike / SentinelOne]

🧾 11. Documentation & Reporting


• Incident logbook
• Daily summary reports
• Weekly trend dashboards
• Compliance logs (for audits)

12. Compliance Mapping (Optional)


Map each SoP element to:
• NIST 800-61
• ISO/IEC 27035
• MITRE ATT&CK tactics

You might also like